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The U.S. Chemical Safety and Hazard Investigation Board (CSB) is an independent federal 
agency whose mission is to drive chemical safety change through independent investigations to 
protect people and the environment 


The CSB is a scientific investigative organization, not an enforcement or regulatory body. 
Established by the Clean Air Act Amendments of 1990, the CSB is responsible for determining 
accident causes, issuing safety recommendations, studying chemical safety issues, and evaluating the 
effectiveness of other government agencies involved in chemical safety. More information about the 
CSB is available at www.csb.gov . 


The CSB makes public its actions and decisions through investigative publications, all of which may 
include safety recommendations when appropriate. Types of publications include: 

Investigation Reports: Formal, detailed reports on significant chemical incidents that 
include key findings, root causes, and safety recommendations 

Investigation Digests: Plain-language summaries of Investigation Reports 

Case Studies: Reports that examine fewer issues than Investigation Reports 

Safety Bulletins: Short publications typically focused on a single safety topic 

Hazard Investigations: Broader studies of significant chemical hazards 

Safety Videos: Videos that animate aspects of an incident or amplify CSB safety messages 


CSB products can be freely accessed at www.csb.gov or obtained by contacting: 

U.S. Chemical Safety and Hazard Investigation Board 

Office of Congressional, Public, and Board Affairs 
1750 Pennsylvania Ave NW, Suite 910 
Washington, DC 20006 
(202) 261-7600 


No part of the conclusions, findings, or recommendations of the Board relating to any accidental 
release or the investigation thereof shall be admitted as evidence or used in any action or suit for 
damages arising out of any matter mentioned in such report. See 42 U.S.C. § 7412(r)(6)(G). 
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1 Executive Summary 

On November 15, 2014, approximately 24,000 pounds a of highly toxic methyl mercaptan was released from an 
insecticide production b unit (Lannate® Unit) at the E. I. du Pont de Nemours and Company (DuPont) chemical 
manufacturing facility in La Porte, Texas. 0 The release killed three operators and a shift supervisor inside a 
manufacturing building. d They died from a combination of asphyxia and acute exposure (by inhalation) to 
methyl mercaptan. 

The CSB determined that the cause of the highly toxic methyl mercaptan release was the flawed engineering 
design and the lack of adequate safeguards. 0 Contributing to the severity of the incident were numerous safety 
management system deficiencies, including deficiencies in formal process safety culture assessments, auditing 
and corrective actions, troubleshooting operations, management of change, safe work practices, shift 
communications, building ventilation design, toxic gas detection, and emergency response. Weaknesses in the 
DuPont La Porte safety management systems resulted from a culture at the facility that did not effectively 
support strong process safety performance. 

The highly toxic methyl mercaptan release resulted from a long chain of process safety management system 
implementation failures stemming from ineffective implementation of the process safety management system at 
the DuPont La Porte facility. 

The CSB investigation viewed the chain of implementation failures as starting with the flawed engineering 
design of the $20 million nitrogen oxides (NO x ) reduced scrubbed (NRS) incinerator, a capital project 
implemented in 2011. DuPont La Porte had long-standing issues with vent piping to this incinerator because the 
design did not address liquid accumulation in waste gas vent header vapor piping to the NRS, and DuPont La 
Porte did not fully resolve the liquid accumulation problem through hazard analyses or management of change 
reviews. Instead, to deal with these problems, daily instructions had been provided to operations personnel to 
drain liquid from these pipes to the atmosphere inside the Lannate® manufacturing building without specifically 
addressing the potential safety hazards this action could pose to the workers. DuPont La Porte’s instructions did 
not specify additional breathing protection for this task (Section 6.4.3 and Interim Recommendations ) [1, p. 18]. 


a 29 C.F.R. $ 1910.119 Appendix A (2013). 

b The Insecticide Business Unit (IBU) was divided into two primary insecticide product lines: Lannate®, which is DuPont’s trade name 
for methomyl, and agricultural products intermediates, which were used to produce insecticides and nematicides known as Vydate®, the 
trade name for oxamyl [1, p. 11]. 

c Multiple business units were located at the DuPont La Porte site. The Lannate® Unit was part of the IBU. In addition to the IBU, the 
facility had an Herbicides Business Unit and a Fluoroproducts Business Unit (FBU). The FBU included an anhydrous hydrogen fluoride 
(HF) manufacturing unit. FBU assets were sold to Chemours on July 1, 2015. 

d One victim on the third floor was located near a methyl mercaptan leak source on the wet end (east) side. The other two victims on the 
third floor were on the dry end (west) side. The IBU was further subdivided into four functional areas: the wet end, the MIC (methyl 
isocyanate) area, the damp end, and the dry end. The wet end contained liquid reaction equipment. The MIC area contained equipment 
to generate and consume the MIC intermediate. The damp end isolated and dried insecticide crystals. The dry end processed the crystals 
and packaged them into various products [1, pp. 10-11]. 

e In September 2018, the CSB produced a Winterization Safety Digest that discussed DuPont La Porte’s lack of safeguards to prevent 
methyl mercaptan hydrate formation [173, p. 1]. 
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On the night of the incident, not realizing the hydrate blockage in the methyl mercaptan feed piping was cleared, 
workers went to drain liquid from the waste gas vent piping. They did not know that high pressure in the waste 
gas vent piping was related to the fact that liquid methyl mercaptan was flowing through the methyl mercaptan 
feed piping and into the waste gas vent piping. 

The chain further developed when the ineffective building ventilation system failed to be addressed after 
DuPont auditors identified it as a safety concern about five years before the incident. DuPont La Porte’s 
management system did not resolve the process safety management recommendation (i.e., did not take 
corrective action) to address the building ventilation system (Section 6.1 and Interim Recommendations ) [1, p. 
34]. The ventilation design for the manufacturing building was based on flammability characteristics and did 
not take into consideration toxic chemical exposure hazards, even though the building contained two highly 
toxic materials, chlorine and methyl mercaptan. DuPont La Porte records indicated that the manufacturing 
building’s dilution air ventilation design was based on providing sufficient ventilation to ensure that the 
concentration of flammable gases did not exceed 25 percent of the lower explosion limit (LEL). a At the time of 
the incident, neither of the manufacturing building’s two rooftop ventilation fans was working, despite an 
“urgent” work order written nearly a month earlier. Even had the fans worked, they probably would not have 
prevented a lethal atmosphere inside the building due to the large amount of toxic gas released (Section 5.4.1.2 
and Interim Recommendations ) [1, pp. 3, 33-34]. 

DuPont La Porte’s installation of a methyl mercaptan detection system inside the manufacturing building added 
another link to the chain. Neither the workers nor the public was protected by DuPont’s toxic gas detection 
system on the night of the incident. The building where the workers died was not equipped with an adequate 
toxic gas detection system to alert personnel to the presence of dangerous chemicals. First, DuPont La Porte set 
the detector alarms well above safe exposure limits for workers. Second, DuPont La Porte relied on verbal 
communication of alarms that automatically displayed on a continuously manned control board. Finally, 

DuPont La Porte did not provide visual lights or audible alarms for the manufacturing building to warn workers 
of highly toxic gas concentrations inside it. When a release caused a detector to register a concentration above 
the alarm limit, the toxic gas detection system did not warn workers in the field about the potential leak and the 
need to evacuate. Among other factors, this detection system contributed to workers’ growing accustomed to 
smelling the methyl mercaptan odor in the unit. Additionally, when the toxic gas detectors triggered alarms, 
DuPont La Porte personnel investigated potential methyl mercaptan leaks without using respiratory protection. 
Personnel normalized unsafe methyl mercaptan detection practices by using odor to detect the gas, further 


a DuPont records indicate that the manufacturing building ventilation system design code is NFPA 497, Recommended Practice for the 
Classification of Flammable Liquids, Gases, or Vapors and of Hazardous (Classified) Locations for Electrical Installations in Chemical 
Process Areas. NFPA 497 defines adequate ventilation as that sufficient to ensure that the concentration of flammable gases does not 
exceed 25 percent of the lower flammability limit (also referred to as lower explosion limit (LEL)) [136, p. 9]. However, there were no 
LEL detectors to monitor the atmospheric conditions inside the manufacturing building and alert workers of potential fire or explosion 
conditions. Furthermore, a methyl mercaptan concentration of 25 percent of the LEL is equivalent to 65 times greater than the 150 parts 
per million concentration that is considered immediately dangerous to life or health (IDLH). 
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deteriorating the importance or effectiveness of utilizing instrumentation in response to alarms signaling 
potential toxic gas releases (Section 3 and Interim Recommendations ) [1, pp. 38-39]. 

In the spring of 2014, the chain propagated when DuPont La Porte’s interlock program did not require 
verification that interlocks that had been bypassed for turnaround maintenance were returned to service before 
the plant resumed operating. Because of this ineffective program, a bypassed interlock caused acetaldehyde 
oxime (AAO), a critical raw material, to become diluted, leading to a shutdown of the Lannate® Unit days 
before the November 2014 incidents During the shutdown, water entered the methyl mercaptan feed piping 
and, due to the cold weather, formed a hydrate (an ice-like material) that plugged the piping and prevented 
workers from restarting the unit. Furthermore, DuPont La Porte did not establish adequate safeguards after a 
2011 DuPont La Porte process hazard analysis identified hydrate formation in this piping, revealing yet another 
link in the chain (Section 6.1 and Interim Recommendations ) [1, p. 22]. 

When the hydrate formed, lacking safeguards to control the potential safety hazards associated with dissociating 
(breaking up) the hydrate (such as using heat tracing to prevent the hydrate from forming a solid inside the 
piping or developing a procedure to dissociate the hydrate safely), DuPont workers went into troubleshooting 
mode (Section 6.3). Ineffective hazard management while troubleshooting the plugged methyl mercaptan feed 
piping formed yet another link in the chain and allowed liquid methyl mercaptan to flow into the waste gas vent 
header piping toward the NRS incinerator—a location where it was never intended to go (Section 6.4.1 and 
Interim Recommendations ) [1, pp. 25-26]. As discussed earlier, DuPont La Porte did not fully resolve liquid 
accumulation in the waste gas vent header by the NRS incinerator. Consequently, DuPont La Porte workers 
dealt with the common problem of liquid accumulation in the waste gas vent header on a routine basis by 
draining the liquid (line breaking) without an engineered solution or without ensuring the use of safety 
procedures or personal protective equipment (Section 6.4.3 and Interim Recommendations ) [1, pp. 18, 28]. 
However, when the liquid drain valves were opened on November 15, 2014, flammable and highly toxic methyl 
mercaptan flowed onto the floor and filled the manufacturing building with toxic vapor. 

Once the methyl mercaptan release began, an ineffective emergency response program at La Porte contributed to 
the extent and duration of the chemical release, placed other workers in harm’s way, and did not effectively 
evaluate whether the chemical release posed a safety threat to the public (Section 3 and Section 4). 


a During the AAO truck unloading, a block valve downstream of what should have been an out-of-service water dilution control valve 
was inadvertently opened, allowing water to flow into the tank. The water dilution system had been installed in 2006 when container 
shipments of 100 percent AAO were judged to be more economical than diluted AAO. AAO is now typically purchased and stored as a 
50 percent solution with water. A logistical problem resulted in an unusual delivery of 50 percent AAO by tank truck instead of by 
railcar. Two factors contributed to the tank overflow incident. First, DuPont did not have a procedure for unloading a 50 percent tank 
truck of AAO. Second, the AAO water dilution control valve was supposed to interlock closed when (1) the truck-unloading pump was 
off or (2) the AAO tank had a high liquid level. However, the interlock function had been bypassed in the field so that water could be 
used to decontaminate the tank during the turnaround in spring 2014. Instrument air supply tubing was connected directly to the 
interlock valve actuator, bypassing the interlock activation solenoid, and forcing the valve to remain fully open. The interlock could not 
function because the bypass was not removed at the completion of the turnaround [1, p. 33]. DuPont defines a safety interlock as a 
system or function that detects an out-of-limits (abnormal) condition or improper sequence and brings it to a safe condition [1, p. 38]. 
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This chain of events illustrates DuPont La Porte’s ineffective implementation of its process safety management 
system. The individual components of this process safety management system exhibited cross-cutting 
weaknesses, resulting in the deaths of four workers and leading to the ultimate decision to close the DuPont La 
Porte facility. 

The DuPont La Porte incident is the CSB’s third investigation of a fatal DuPont incident in five years. a On 
September 30, 2015, the CSB issued a presentation , a safety video , and an Interim Recommendations report [1], 
which detailed needed safety improvements at the DuPont La Porte facility and issued recommendations for 
implementation before resuming operations of the Lannate® Unit [2]. b Due to the amount of methyl mercaptan 
stored at the DuPont La Porte site, the Lannate® process was covered by the Process Safety Management (PSM) 
standard of the U.S. Occupational Safety and Health Administration (OSHA) and the Risk Management Plan 
(RMP) rule of the U.S. Environmental Protection Agency (EPA) [3]. In the Interim Recommendations , the CSB 
identified significant process safety management deficiencies at the La Porte facility, including delayed 
maintenance of safety-critical equipment, lack of written procedures, poor hazard analysis practices, lack of 
implementation of important inherently safer design concepts, and a lack of hazard recognition [1]. 

In response to the CSB findings and recommendations, DuPont committed to making changes at the La Porte 
facility. DuPont La Porte, however, was not able to address all of these findings and recommendations, because 
in the spring of 2016 DuPont announced that it would not reopen the Lannate® Unit. The company had 
determined that “significant changes in market conditions during the period of the shutdown [would] persist 
over the long term” [4] and that the cost required for the restart was “not a long-term viable and cost-efficient 
option for the DuPont Crop Protection business” [5]. In 2017, DuPont dismantled and removed from the 
DuPont La Porte facility the buildings and equipment that had been associated with its insecticide and herbicide 
business units, including the Lannate® Unit. 0 

Despite the closure of the insecticide and herbicide units, the CSB determined that the DuPont La Porte incident 
offers important lessons for the chemical industry relating to the following areas: 

• Emergency Response . The emergency response efforts at the DuPont La Porte facility during the 

toxic chemical release were disorganized and placed at risk operators, emergency responders, and 


a The CSB also investigated an incident at a DuPont plant in Belle, West Virginia (three incidents that occurred in a 33-hour period over 
January 22-23, 2010, resulting in one fatality) [121], and another in Buffalo, New York (a single incident that occurred on November 9, 
2010, resulting in one fatality and one serious injury) [122]. 

b This report incorporates by reference the DuPont La Porte Interim Recommendations [1]. 

c Although DuPont dismantled the La Porte Crop Protection business, DuPont La Porte still operates as a landlord to other companies 
located at the La Porte site and provides wastewater treatment and utilities, as well as owning the emergency response program. 
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potentially the public. Chemical plants need a robust emergency response program to mitigate 
emergencies and to protect the health of workers, emergency responders, and the public. a 

• DuPont’s Process Safety Management System . DuPont created its own corporate process safety 
management system that integrated its internal safety requirements with those of the American 
Chemistry Council’s Responsible Care® program 13 and those required by regulations under the EPA 
RMP rule and the OSHA PSM standard. Over the course of five years, despite implementing its 
corporate process safety management system, DuPont experienced three major process safety 
incidents. 

In addition to developing an integrated process safety management system, DuPont established a 
program to implement it. According to DuPont, the implementation of the process safety 
management system can be broken down into two parts: (1) Building a Safety Culture and (2) Using 
the Process Safety Management and Risk Model. Although DuPont’s corporate standard 
recommended that its sites assess their process safety culture, DuPont La Porte had not formally 
evaluated process safety culture at its facility before the November 2014 incident. DuPont La Porte 
used a proprietary Safety Perception Survey that focused on personal or occupational safety but did 
not evaluate or assess the process safety culture. Because the Safety Perception Survey did not 
reasonably evaluate all safety aspects of culture, it could not help identify the significant process 
safety weaknesses at the DuPont La Porte facility, leaving the site vulnerable to potential process 
safety incidents. While measuring worker perceptions of personal safety is important, a safety 
culture assessment program should also provide an effective gauge of process safety. The second 
tool that DuPont used to implement its process safety management system was the Process Safety 
Management and Risk Model, the company’s visual representation of an effective process safety 
management system, showing the implementation and interaction of Management Leadership and 
Commitment, Comprehensive Process Safety Management Program, and Operational Discipline. 

• DuPont La Porte’s Process Safety Management Deficiencies . The CSB identified significant 
process safety deficiencies at the DuPont La Porte site that contributed to the incident. DuPont’s 
corporate process safety management system did not identify, prevent, or mitigate these 
deficiencies. A company must effectively implement a process safety management system and its 
corresponding programs to reap the accompanying process safety benefits. 


a Emergency response and planning is one of five key safety topics that the CSB found needed improvement across industry nationwide; 
as a result, the CSB included that topic in its Drivers of Critical Chemical Safety Change program. Inadequate or poor emergency 
planning or response is a recurring finding in CSB investigations. At least 17 CSB incident investigations , including this one, identified 
emergency response deficiencies, resulting in 46 emergency response recommendations [33]. 

b The American Chemistry Council (ACC) is a trade group that represents chemical companies. ACC’s Responsible Care Program is a 
voluntary industry program. 
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• DuPont La Porte ’s Employee Incentive Program . The DuPont La Porte bonus structure may have 

disincentivized workers from reporting injuries, incidents, and “near misses.” Ensuring that 
employees can report injuries or incidents in accordance with the Occupational Safety and Health 
(OSH)Act and OSHA regulations, without fear of discrimination, retaliation, or other adverse 
consequence is central to protecting worker safety and health, and aiding accident prevention. 

This report encourages legacy DuPont* sites to strengthen employee incentive programs. It additionally presents 
a set of recommendations to the DuPont La Porte facility and Local 900C of the International Chemical Workers 
Union Council (ICWUC) of the United Food and Commercial Workers (UFCW) to improve emergency 
preparedness and response at the La Porte facility. Based on the CSB’s investigative findings related to 
emergency response, process safety management systems, and incentive programs (see Appendix A: Causal 
Analysis), this report presents lessons for the chemical industry in Guidance to Industry sections and 
summarizes them at the end of the report in Section 9: Safety Guidance. 


a DuPont and Dow completed a merger of equals on August 31, 2017. The combined entity operated as a holding company called 
DowDuPont [105]. On April 1, 2019, DowDuPont successfully completed the spin-off of its Material Science division, Dow. 
DowDuPont intends to separate its Agriculture and Specialty Products divisions into independent, publicly traded companies by June 
2019, subject to board approval [134]. 
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2 Incident Description 

The November 15, 2014 incident occurred in DuPont 
La Porte’s Lannate® a Unit, which produced 
insecticides. Part of the Lannate® process occurred 
inside a closed building (the manufacturing building) 
(Figure l), b where most of the methyl mercaptan 
release occurred. 0 The Lannate® process used methyl 
mercaptan, a toxic and flammable chemical. d,e 



Figure 1. The Lannate® Manufacturing Building. The methyl 
mercaptan release occurred in the manufacturing building. Source: 
CSB. 


a Lannate® is the DuPont trade name for methomyl, an insecticide [94, p. 1]. For more detail on the incident, see public meeting 
presentation . DuPont La Porte animation , public meeting transcript , and Interim Recommendations report [2]. 
b Chlorine and methyl isocyanate (MIC) were also used in the manufacturing building. 

0 Although the bulk of the release occurred inside the manufacturing building, methyl mercaptan was also released from the nitrogen 
relief valves located at the methyl mercaptan railcar spots. 

d Symptoms of methyl mercaptan toxicity include narcosis (a state of stupor, drowsiness, or unconsciousness) and cyanosis (blue or 
purple coloration of the skin or mucous membranes caused by inadequate oxygenation of the blood) [50]. Methyl mercaptan is also a 
chemical asphyxiant [95]. Chemical asphyxiants are toxic agents that prevent red blood cells from carrying oxygen [90, p. 58]. The 
OSHA ceiling exposure limit is 10 parts per million (ppm). OSHA recommends that employers consider using the alternative 
occupational exposure limits because the agency believes that exposures above some of these alternative occupational exposure limits 
may be hazardous to workers, even when the exposure level complies with the relevant permissible exposure limit (PEL) [162]. The 
Division of Occupational Safety and Health of California (Cal-OSHA) PEL is an 8-hour time-weighted average (TWA) of 0.5 ppm, and 
the National Institute of Occupational Safety and Health (NIOSH) recommends a recommended exposure limit (REL) of a 15-minute 
ceiling limit of 0.5 ppm [163]. Methyl mercaptan is immediately dangerous to life and health at 150 ppm [50]. For methyl mercaptan, the 
10-minute acute exposure guideline level (AEGL)-2 (disabling) is 40 ppm and the 10-minute AEGL-3 (lethal) is 120 ppm. According to 
the National Center for Biotechnology Information, “AEGL-2 is the airborne concentration (expressed as ppm or mg/m 3 ) of a substance 
above which it is predicted that the general population, including susceptible individuals, could experience irreversible or other serious, 
long-lasting adverse health effects or an impaired ability to escape. AEGL-3 is the airborne concentration (expressed as ppm or mg/m 3 ) 
of a substance above which it is predicted that the general population, including susceptible individuals, could experience life-threatening 
health effects or death” [130]. 

e Methyl mercaptan is flammable at concentrations between 3.9 percent and 21.8 percent in air [50]. 


FINAL COPY 


Page 13 

















U.S. Chemical Safety and 
Hazard Investigation Board 


Toxic Chemical Release at the 
DuPont La Porte Chemical Facility 

La Porte, Texas | Incident Date: November 15, 2014 | No. 2015-01-l-TX 


The sections below discuss the events a leading to the methyl mercaptan release and the subsequent emergency 
response. 

2.1 Methyl Mercaptan Release 

On Monday, November 10, 2014, an inadvertent chemical dilution caused operating difficulties that forced a 
shutdown of DuPont’s Lannate® Unit. b In response, DuPont La Porte personnel adjusted the unit’s control 
system to resume operations. On Wednesday, November 12, 2014, operators tried to restart the Lannate® 
process. During the shutdown, the methyl mercaptan piping to the reaction section of the process had become 
plugged due to the formation of a clathrate hydrate (hydrate), 0 halting restart. At that time, operators did not 
know the source of the plugging and began troubleshooting the process to try to clear the piping, unaware that 
the solid hydrate had formed. 

Two days later, on Friday, November 14, 2014, the troubleshooting efforts to clear the plugging were still 
ongoing. That morning, the Lannate® Unit Technical Team (Technical Team), composed of engineers and other 
employees experienced in the process, met with operations personnel to discuss troubleshooting options to clear 
the plugging. This meeting identified the likely scenario that water had entered the methyl mercaptan system, 
forming a solid hydrate. 

DuPont’s methyl mercaptan technical standard identifies the potential to form a hydrate at low temperatures. 

The technical standard states that methyl mercaptan “will form a hydrate with water, which is a solid below 40 
deg F [degrees Fahrenheit] per information provided by a [methyl mercaptan] supplier.” Based on this 
understanding, the Technical Team asked that operators put hot water on the outside of the methyl mercaptan 
piping, under the insulation, to warm the piping and its contents to break up (dissociate^ the plugging. The 
Technical Team also realized that when heated, methyl mercaptan would expand, requiring a safe place to vent 
to avoid over-pressuring the piping. To address this concern, operations personnel opened valves between the 
methyl mercaptan piping and a waste gas vent header (vent header), not recognizing that this alignment created 


a The sequence of events is also presented in 


Appendix B: Incident Timeline. 

b The chemical involved in this dilution was acetaldehyde oxime (AAO). Additional information about the AAO dilution portion of the 
incident is in the CSB DuPont La Porte Interim Recommendations [1, pp. 20-21]. 

c At low temperatures (< 52 degrees Fahrenheit (°F)), water and methyl mercaptan form a solid, ice-like material called methyl 
mercaptan clathrate hydrate [72]. Temperatures in the Houston area for the 24 hours preceding the incident averaged approximately 
40°F and had been consistently below 55°F since Tuesday, November 11, 2014. Although the potential for methyl mercaptan hydrate 
formation had been identified in DuPont’s methyl mercaptan technical standard and in process hazard analyses years earlier, DuPont 
never implemented safeguards, such as heat tracing, or developed a procedure to dissociate the hydrate safely [1, p. 22]. 
d Methyl mercaptan clathrate hydrate dissociates back to the liquid phases of methyl mercaptan and water at approximately 52°F [72]. 
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a pathway for liquid methyl mercaptan to eventually release from the piping inside the manufacturing building 
when drain valves were opened. 

In addition, when operations personnel opened other valves while troubleshooting, such as drain valves, methyl 
mercaptan was released to the atmosphere, causing a strong methyl mercaptan odor a that could be smelled by 
site personnel. During troubleshooting, methyl mercaptan was released both outside and inside the 
manufacturing building, triggering 32 methyl mercaptan gas alarms b on the control panel throughout the 17 
hours preceding the incident. Although methyl mercaptan is a toxic and flammable chemical, and at high 
enough concentrations lethal, some operations personnel did not respond in accordance with the nature of the 
emergency circumstances because they associated the alarms with the ongoing troubleshooting efforts. They 
did not perceive the methyl mercaptan alarms as signifying a serious hazard because they had normalized 0 the 
methyl mercaptan odor within the Lannate® Unit, as well as the detector alarms. 

Early in the morning on Saturday, November 15, 2014, the hot water from the hoses warmed the hydrate 
plugging, causing it to dissociate, clearing the plugging. Due to the valve alignment, liquid methyl mercaptan 
flowed into the waste gas vent header, located inside the manufacturing building [1, pp. 25-26]. The vent 
header, however, was not intended nor designed for liquid methyl mercaptan. At 2:51 am, alarms began to 
sound on the control system indicating high pressure in equipment inside the manufacturing building. 

Operations personnel did not realize that liquid methyl mercaptan was causing the high pressure. Instead, they 
attributed the high pressure to a common, long-standing problem with process condensate, which DuPont La 
Porte personnel believed to be mostly water, accumulating in the vent header piping [1, p. 28]. The Lannate® 
control room board operator (Board Operator) contacted the night shift supervisor (Shift Supervisor) and another 
operator (Operator 1) separately, asking them to help troubleshoot the high-pressure situation. Manually 
draining the vent header inside the manufacturing building, a long-standing practice, was the typical approach 
used to remove process condensate from the vent header, as it successfully reduced system pressure many times 


a Methyl mercaptan has a low odor threshold. It gives off a smell like rotten cabbage. It can be smelled at only two parts per billion 
(ppb) [80, p. 1]. OSHA’s permissible exposure limit (PEL), however, is 10 parts per million (ppm), which is 5,000 times the minimum 
concentration that can be smelled. The low odor threshold of mercaptans makes them useful as fuel gas odorants [80, p. 2]. 
b DuPont used hydrogen sulfide (EES) detectors to identify methyl mercaptan. The alarms activated when the detectors sensed the 
hydrogen sulfide equivalent of 25 ppm methyl mercaptan. Twenty-five ppm is the ERPG-2 level for methyl mercaptan (see Section 4.8) 
[82, p. 27]. This level “is the maximum airborne concentration below which nearly all individuals could be exposed for up to 1 hour 
without experiencing or developing irreversible or other serious health effects or symptoms which could impair an individual’s ability to 
take protective action.” Emergency responders use ERPG-1, -2, and -3 concentration data to determine how to protect the public [167]. 
DuPont records indicate that the device manufacturer stated the detector should be capable of detecting methyl mercaptan within 1 ppm 
[1,P- 37]. 

c Normalization of deviance is a phenomenon in which individuals or work teams gradually accept a lower standard of performance until 
the lower standard becomes the norm. It is typically the result of slowly changing and eroding conditions over time [79, p. 4]. 
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in the past. a The Shift Supervisor and Operator 1 each went separately to the manufacturing building, likely in 
order to drain liquid from the vent header piping manually. 

Sometime between 3:01 am and 3:13 am, a worker (likely the Shift Supervisor) 13 manually opened two sets of 
drain valves on the vent header piping, located on the third floor of the manufacturing building (Figure 2). But 
instead of the expected condensate composed mostly of water, the liquid methyl mercaptan that had filled the 
piping escaped out of the valves, vaporized, and killed the Shift Supervisor. Between 3:24 am and 3:26 am, 
three methyl mercaptan detectors inside the manufacturing building sensed at least 25 parts per million (ppm) c 
of methyl mercaptan d and triggered alarms at the control panel (Figure 3). The Board Operator—still focused 
on reducing the high pressure—did not realize a major chemical release was occurring inside the manufacturing 
building (Section 3). 


a In 2011, DuPont installed a NO x (nitrogen oxides) reduced scrubbed (NRS) incinerator system. The waste gas vent header piping to the 
NRS incinerator was designed without sufficient consideration of liquid accumulation. It contained low points where liquid could 
accumulate, and there was no engineered equipment provided, such as a knock-out drum, to remove liquid safely from the waste gas vent 
header piping system. The liquid accumulation in the piping would create pressure in process equipment. Pressure buildup within the 
equipment was resolved by manually draining liquid from the waste gas vent header. See Section 6, Process Safety Management 
Deficiencies, and DuPont La Porte, Texas Chemical Facility Toxic Chemical Release: Interim Recommendations [1, p. 18]. 
b The Shift Supervisor was most likely the worker who opened the valves, based on both the location in the manufacturing building 
where he was recovered and information learned in interviews that suggested he was the worker most likely to have opened those specific 
valves to drain the vent header piping. 

c The methyl mercaptan detectors were evaluated post-incident. Although the detectors inside the building have the ability to span 0-50 
ppm, these detectors were set to span 0-25 ppm. Post-incident, the span was increased to 50 ppm. Additionally, information from the 
methyl mercaptan detectors inside the manufacturing building displayed only on the distributed control system (DCS) monitor and was 
not recorded by the site’s DCS and data historian [1, p. 37]. CSB investigators, however, were able to obtain information about the 
alarms associated with the detectors from alarm logs. 

d The methyl mercaptan detectors alarm at 25 ppm—well above the NIOSH recommended exposure limit (REL) of 0.5 ppm and the 
OSHA enforceable PEL ceiling limit of 10 ppm. OSHA recommends that employers consider using the lower alternative occupational 
exposure limits because the agency believes that exposures above some of these alternative occupational exposure limits may be 
hazardous to workers, even when the exposure levels comply with the relevant PELs [149]. The Cal-OSHA permissible exposure limit 
(PEL) is an 8-hour time-weighted average (TWA) of 0.5 ppm, and the NIOSH REL is a 15-minute ceiling limit of 0.5 ppm [159], [50]. 
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Figure 2. Waste Gas Vent Header Piping on the Third Floor of the Manufacturing Building. This portion, where several waste gas 
sources come together, is referred to as the waste gas vent header. Waste gas from this portion of the vent header traveled up to 
reach the NRS incinerator, a piping configuration that created a low spot where liquid accumulated. To remove the liquid during waste 
gas vent header piping high-pressure events, operators were instructed to open valves (yellow circle) and drain the system through a 
hose routed to a floor drain located near a safety shower. The floor drain is connected an open trench-type sump on the first floor. At 
the time of the incident, a second set of drain valves (red circle) were also opened directly to the floor inside the manufacturing 
building. Source: CSB. 
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North 
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Figure 3. Depiction Showing Where Drain Valves Were Opened. These drain valves released toxic methyl mercaptan into the 
manufacturing building. Methyl mercaptan detectors on the first and fourth floors detected high concentrations of methyl 
mercaptan shortly after the release began. This depiction is a simplified graphic of the manufacturing building (see Section 4.5) and 
does not show the location of Operator 1. Source: CSB. 

At about 3:30 am, Operator 1 made an urgent call for help over the radio. Various personnel interpreted her 
communication in different ways, generally as either “We need help!” or “I need help on the fourth floor!” The 
Board Operator tried to get more information through radio communication, but neither the Shift Supervisor nor 
Operator 1 ever responded [1, p. 29]. 

Two operators (Operator 2 and Operator 3) who were in the control room and heard the distress call ran to the 
manufacturing building to help. Another operator (Operator 4) saw Operator 2 and Operator 3 running to the 
manufacturing building, and he followed them. None of these operators knew of the major release of toxic 
methyl mercaptan inside of the manufacturing building; therefore, they did not wear any respiratory protection 
when they ran into the manufacturing building. The manufacturing building lacked automatic visual or audible 
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alarms to alert fieldworkers or prevent them from entering a potentially toxic atmosphere (Section 3). In 
addition, the building’s ventilation fans were not working, a situation that, in DuPont’s operating procedures, 
required “restricted access” to the building. But DuPont La Porte’s procedures did not define “restricted access” 
or require that operators wear respiratory protection in the building when access was restricted, even though a 
toxic chemical release could accumulate in the unventilated building [1, p. 29]. 

Operator 2, Operator 3, and Operator 4 each entered the south stairway and took different a route inside the 
manufacturing building to try to find Operator 1 (Figure 4). Operator 2 went to the third floor, where he was 
fatally overcome by methyl mercaptan [1, p. 29]. Operator 4 went to the second floor. He walked about 10 feet 
and hit what he later described as a “wall” of methyl mercaptan, but he managed to retreat to the stairwell [1, p. 
29]. Operator 3 went to the fourth floor but did not find anyone. He then announced on the Lannate® Unit’s 
public-address system that he did not see anyone on the fourth floor. The Board Operator responded that the 
Shift Supervisor and Operator 1 may be on the third floor [1, p. 29]. Operator 3 then began to feel light-headed. 
He made his way to the stairwell and lost consciousness while descending from the fourth floor [1, p. 29]. 
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Figure 4. Depiction of Paths Taken by Operator 2, Operator 3, and Operator 4 When Whey Responded to Operator l's Distress Call. 
Locations of the deceased Shift Supervisor and Operator 1 are also shown. Operator 2 was killed by methyl mercaptan exposure, 
and Operator 3 and Operator 4 were exposed to high concentrations of methyl mercaptan. This figure shows the opposite side of 
the manufacturing building from the view in Figure 3. Source: CSB. 


The Board Operator then tried to reach the Shift Supervisor, Operator 1, and Operator 2 over the radio, but they 
did not respond. An operator in the control room, Operator 6 a (the brother of Operator 2), then grabbed three 5- 
minute escape respirators. Other operators in the control room warned him not to enter the manufacturing 
building because they did not know what was going on or where the nonresponsive operators were. Operator 6, 
however, took the escape respirators and rushed to the manufacturing building [1, p. 29]. 

At about 3:40 am, Operator 6 encountered Operator 4 in the south stairway of the manufacturing building and 
put an escape respirator on him (Figure 5). The breathing air helped Operator 4 recover, and he exited the 
manufacturing building safely. A worker—likely Operator 6—then manually activated the manufacturing 
building fume release alarm, an alarm intended to alert area workers of a toxic chemical release in the building. 
Operator 6 then went to the third floor of the manufacturing building. At some point after helping Operator 4, 


a Operator 6 was a board operator for another process in the Lannate® Unit. 
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Operator 6 retrieved a self-contained breathing apparatus (SCBA) from inside the manufacturing building. He 
tried to rescue his brother (Operator 2) by putting one of the escape respirators on his face. Operator 6 was then 
fatally overcome by methyl mercaptan before he could connect his own respirator mask to his SCBA tank. 
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Stairwell 
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Methyl mercaptan 
release points 


Shift supervisor 
(deceased) 


Operator 6 attempted to 
rescue his brother (Operator 2) 
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Operator 6 


Operator 2 


(deceased) 
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1 Operator 1 
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At 3:40 am. Operator 6 
encountered Operator 4 in 
stairway and put an escape 
respirator on him, which 
helped Operator 4 escape the 


' --building safely 


Figure 5. Depiction of the Path Taken by Operator 6 Inside the Manufacturing Building. Operator 6 helped Operator 4 escape by 
providing him with a respirator. Operator 6 was fatally overcome by methyl mercaptan when trying to rescue his brother, 
Operator 2, on the third floor. Source: CSB. 


2.2 Emergency Response 

At about 3:50 am, the Board Operator called for the plant emergency response team (ERT) a to respond to the 
manufacturing building, stating over the intercom system, “We need rescue people, and there’s people missing.” 


a At the time of the incident, three companies (DuPont, Kuraray, and Invista) operated at the La Porte site and shared one ERT for the 
site, which had members from each company and was managed by DuPont. The ERT members worked other, primary jobs for one of 
the three companies (such as unit operators), and they responded as ERT members during emergencies. The site’s ERT staffing included 
about 60 employees. Section 4.1 discusses the composition of the ERT in more detail. 
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This announcement started a chain of miscommunication. To the ERT, a request for “rescue” meant specifically 
high-angle a or confined-space rescue. Therefore, the ERT responded to the request for help by gathering only 
technical rescue gear (e.g., harnesses and ropes), not knowing that there was a major toxic chemical release 
(Section 4.3.1) [l,p. 30]. 

At 3:57 am, the Board Operator called the security guard at the main entrance to ask the guard to call 9-1-1. The 
Board Operator communicated only that workers were missing and requested rescue. The guard, in turn, gave 
limited information to the 9-1-1 operator: 

9-1-1 Operator: Harris County 911. What is the location of your emergency? 

Caller: This is DuPont on Strang Road.... They had an emergency out here. They got four people 
missing.... I was just called by the Lannate® supervisor [Board Operator] that he has four people 
missing. 

9-1-1 Operator: So, are they somewhere there, or you don’t know where they’re at? 

Caller: I don’t know, ma’am. I am up in the front. I just got the phone call. 

9-1-1 Operator: Okay, you don’t know their names or anything? 

Caller: No ma’am, just they needed rescue. 

9-1-1 Operator: They need rescue? 

Caller: Yes ma’am. 

9-1-1 Operator: And you don’t know their names, no descriptions, nothing? 

Caller: No ma’am. I just know that they’re workers. 

At 3:58 am, site emergency responders from the ERT arrived at the scene with only their technical rescue gear. 
They quickly realized that there was an ongoing chemical release and that they needed additional personal 
protective equipment (PPE). At 4:05 am, the Incident Commander, who had responded to the initial rescue 
request, called for the ERT to come to the scene with bunker gear b and SCBAs—the PPE necessary to enter an 
area with a toxic and flammable chemical release. When ERT members attempted to start the mini-pumper 
truck that contained SCBAs and radios, however, it would not start and could not make it to the incident scene 
(Section 4.3.2). c 


a A high-angle rescue uses a variety of technical rope rescue techniques to retrieve injured or otherwise incapacitated persons on terrain at 
slopes of 60° or greater. Victims are hoisted from one level to another using ropes, pulleys, harnesses, belay devices, and various hauling 
implements [120]. 

b “Bunker gear” is a common term for firefighting protective clothing [96]. 
c The mini-pumper truck was located more than 2,000 feet from the control room. 
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The Incident Commander also requested safety data sheets for chemicals processed inside the manufacturing 
building, including methyl mercaptan. The ERT, however, did not initially use air monitoring equipment to 
determine what chemical was leaking. According to DuPont La Porte’s Lannate® emergency response plan, a 
area personnel control air monitoring equipment for their unit. Because the Shift Supervisor (Process 
Coordinator) who oversaw process operations was a victim of the incident and was not available to fulfill the 
assigned role of providing chemical hazard and unit-specific information about each of the processes to the ERT 
during an emergency, air monitoring was delayed during the early hours of the incident. Meanwhile, site 
personnel recognized the release by odor and believed that methyl mercaptan was the chemical leaking inside 
the building. b 

At around 4:10 am, the Incident Commander established a hot zone around the manufacturing building. The hot 
zone’s boundaries, however, were not clearly communicated or marked by the ERT (Section 4.7). 

At 4:12 am, an emergency operations center coordinator made a second 9-1-1 call, but he had not yet been 
informed by ERT personnel what chemical was leaking, or whether the leak posed a public threat, and was 
therefore unable to relay this critical information to the 9-1-1 operator: 

9-1-1 Operator: Harris County 911. What is the location of your emergency? 

Caller: This is in La Porte, Texas.... We have an emergency at the DuPont Plant in La Porte.... 

We have a possible casualty five, is what my medics are telling me. We have some injuries. We 

need La Porte EMS for transportation.... 

9-1-1 Operator: Okay, sir. How did this happen? Is it chemical-related? 

Caller: I am not certain. I just know ... they’re doing a rescue—they’re doing a rescue right now. 

We have some injured people. I’m not sure if there’s any chemicals involved or not. I am just 

relaying the message. 


Caller: I have just got some more information. We have five people unaccounted for. We have 
had a chemical release ... Iam not sure what chemical, in one of our buildings. Five people are 
unaccounted for. Rescue team is trying to reach them at this point. That’s all the information I 
can give you right now. 


a The Lannate® Unit emergency planning and response manual was developed to comply with the OSHA Process Safety Management of 
Highly Hazardous Chemicals standard, 29 C.F.R. $ 1910.119(n) (2013) . Under this standard, facilities are required to develop an 
emergency action plan and potentially an emergency response plan ( 29 C.F.R. $ 1910.38 (2002) ; 29 C.F.R. §§ 1910.120 (a). (p), and (q) 
(2013) ). An emergency response plan under the Hazardous Waste Operations and Emergency Response (HAZWOPER) standard is 
required if an internal emergency response team is responding to or has substantial threat of responding to releases of hazardous 
substances ( 29 C.F.R. §§ 1910.120 (a)(2)(iv) and (g)(1) (2013) ). Because the La Porte site had an internal emergency response team that 
responded to releases of hazardous substances, HAZWOPER required that the site have an emergency response plan. 
b Using smell to locate or characterize sources of a release is a poor practice. Chemicals have different physical properties, including 
olfactory fatigue, no odor, and toxicity if inhaled. 
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9-1-1 Operator: Okay sir. And can you tell me, is this any risk to the public? Is it going to be a 
possible escaping from your premises? 

Caller: No ma’am, it is not. 

9-1-1 Operator: No threat? 

Caller: No ma’am. 


9-1-1 Operator: And we don’t know what kind of chemical it is? 

Caller: No ma’am. As soon as I find out, I will let you know. I’ve got my team trying to 
determine that right now. 


At about 4:15 am, ERT members assigned an operator 
(Operator 7) to bring them SCBAs because the ERT 
mini-pumper truck holding SCBAs could not respond 
to the scene. DuPont stored additional SCBAs outside 
a building closer to the manufacturing building. 
Assisting the ERT as requested, Operator 7 went alone 
to retrieve these SCBAs and unknowingly walked into 
the path of the methyl mercaptan being released from 
the manufacturing building (Figure 6). a The hot zone 
was not clearly identified or communicated to plant 
personnel. As a result, when Operator 7 went to 
retrieve the SCBAs, she was unaware that she was 
entering a potentially hazardous area. When Operator 
7 went outside, though unable to smell methyl 
mercaptan, she felt ill. b Realizing that she might be in 
a dangerous position, she retreated to the control room c 
(Section 4.7). 


Figure 6. Depiction of Path Taken by Operator 7 to Retrieve 
SCBAs for ERT When the Mini Pumper Truck Would Not Start. 
The hot zone was not controlled adequately to ensure that 
personnel did not enter a hazardous area. Source: Google 
Earth, with annotations by CSB. 
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a At 3:50 am, at Ellington Field, Texas (about 10.5 miles southwest of the DuPont La Porte facility), the wind was blowing from the 
northeast at 8.1 miles per hour (mph) [100]. 

b These symptoms are consistent with methyl mercaptan exposure. Olfactory fatigue is known to occur with exposure to methyl 
mercaptan, resulting in the exposed person not being able to detect the chemical by smell. Inhaling methyl mercaptan can also induce 
headaches, dizziness, nausea, vomiting, coma, and death [80]. 

c Operator 7 believes she was exposed to a high concentration of methyl mercaptan, but she was able to return to safety. 
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At about 4:20 am, Operator 3 regained consciousness and managed to exit the manufacturing building [1, p. 29]. 
ERT members saw him near the manufacturing building and escorted him to safety. 

Beginning at about 4:25 am, the first ERT entry team entered the manufacturing building. Although the ERT 
used breathing air (SCBAs) to protect themselves from toxic exposure, they did not monitor the atmosphere 
during this building entry to assess explosive hazards. Portions of the building likely had an explosive 
atmosphere during the incident (Section 4.4.1), and air monitoring could have alerted personnel to this potential 
hazard during this entry. The ERT’s post-incident critique stated “metering and [air] monitoring equipment 
were maintained by the unit. Since the technical knowledge base a was incapacitated, there was a delay in 
establishing [air] monitoring.” 

During the building entry, an ERT member found drain valves b from the waste gas vent header on the third floor 
open, with a gas (later identified as methyl mercaptan) flowing from them. The ERT members also found the 
Shift Supervisor on the floor of the third story, about 30 feet north of the drain valves. They also found 
Operator 6 next to his brother (Operator 2), and both men were unresponsive. Operator 2 had a 5-minute escape 
respirator bag over his head. This respirator was one of the three escape packs brought into the building by 
Operator 6. Operator 6 had a 30-minute SCBA air bottle in front of him and the mask on his face, but he had 
not connected the mask to the air bottle. Methyl mercaptan likely incapacitated Operator 6 while he was trying 
to don his SCBA [1, p. 31]. A postmortem examination determined that the Shift Supervisor, Operator 2, and 
Operator 6 were killed by asphyxia through exposure to methyl mercaptan. 

During the release, the ERT used a plume dispersion model to predict the methyl mercaptan plume (cloud) size 
and concentration profile releasing from the manufacturing building. To predict the methyl mercaptan plume 
effectively, the modeling software required an estimate of the methyl mercaptan release rate. The emergency 
response personnel, however, did not have an available method to estimate the methyl mercaptan release rate. 
Lacking other data sources and based on the perceived low odor of methyl mercaptan outside the manufacturing 
building, they estimated a release rate of 10 pounds per hour. With this input, the model predicted that methyl 
mercaptan would not leave DuPont property at concentrations harmful to the public. The CSB determined, 
however, that the emergency response personnel greatly underestimated the release rate. It was not possible for 
the CSB to determine the exact off-site methyl mercaptan concentration immediately after the release; however, 
the CSB concluded that the total release of about 24,000 pounds of methyl mercaptan created the potential for a 
dangerous concentration of methyl mercaptan to have been released off-site (Section 4.8.1). 

Beginning at 5:08 am, three external firefighter groups arrived on-site, and at 5:15 am the ERT conducted its 
second entry into the manufacturing building. On the third floor, an ERT responder closed the open drain valves 
from which he had observed vapor (methyl mercaptan) escaping. 


a The Shift Supervisor who served as the Process Coordinator—that is, the technical liaison—was killed by the release. 
b These drain valves were not closed at this time. 
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At about 5:40 am, emergency responders established and barricaded the hot zone. Until this point, the hot zone 
had not been marked clearly. At 5:57 am, the Incident Commander requested Harris County personnel to 
perform air monitoring off-site. 

At 6:02 am, approximately three hours after the release started, DuPont La Porte personnel turned off the methyl 
mercaptan storage tank pump, which had been operating since the last startup attempt, before the release began 
(Figure 7). Shutting off this pump significantly slowed the methyl mercaptan release rate (Section 4.6). a 



Methyl Mercaptan 
Storage Tank 


Manufacturing 

Building 


Methyl Mercaptan 
Pump 


Figure 7. Location of Methyl Mercaptan Pump. The pump was turned off nearly three hours after the release began. Source: 

Google Earth, with annotations by CSB. 

From 6:10 am to 9:30 am, the ERT conducted the third, fourth, and fifth ERT building entries to search for 
Operator 1, who was still missing. Due to the complex layout and emergency responders’ lack of knowledge of 
the manufacturing building, the emergency responders had difficulty finding Operator 1. They had no maps to 
reference during their search, and DuPont La Porte did not have cameras in the manufacturing building to 


a The design of the nitrogen relief valves at the railcar loading and unloading stations did not consider a scenario in which the relief 
valves could be lined up with the discharge of the methyl mercaptan pumps, as they were at the time of the incident. The methyl 
mercaptan pump discharge pressure (90 pounds per square inch gauge (psig)) was higher than the set pressure (80 psig) of these nitrogen 
relief valves. Therefore, the methyl mercaptan pump would cause the relief valve to open and release the highly toxic and highly 
flammable chemical to the atmosphere. When tested post-incident, three of the four nitrogen rupture discs burst, and all four of the 
nitrogen relief valves leaked. Because the rupture discs and relief valves would not hold pressure when tested, an atmospheric release of 
highly toxic and highly flammable liquid methyl mercaptan likely occurred during the incident through this relief system that was 
intended to release and disburse nitrogen vapor [1, p. 46]. A rupture disc is a non-reclosing pressure relief device, a type of emergency 
relief device. According to the Center for Chemical Process Safety (CCPS), an emergency relief device is designed to open during an 
emergency or during abnormal conditions to prevent rise of internal fluid pressure in excess of a specified value. The device also may be 
designed to prevent excessive internal vacuum [110]. For more information on pressure relief devices, see “ An Overview of Pressure 
Relief Devices ” [ 111, pp. 20-27]. 


FINAL COPY 


Page 26 






























U.S. Chemical Safety and 
Hazard Investigation Board 


Toxic Chemical Release at the 
DuPont La Porte Chemical Facility 

La Porte, Texas | Incident Date: November 15, 2014 | No. 2015-01-l-TX 


provide a view of the different floors of the building (Section 4.5). To facilitate the search efforts, the ERT 
assigned area operators—including the Board Operator—to draw building maps to help emergency responders 
navigate the manufacturing building. During this time, ERT responders continued closing valves throughout the 
Lannate® Unit to stop the release of methyl mercaptan. 

At 6:14 am, a Harris County Sheriffs sergeant noticed an “intense smell” in Deer Park (west of La Porte), and 
at 6:30 am, he communicated, “the odor on [Highway] 225 [is] strong” (Figure 8). 

At 8:07 am, Harris County’s Hazardous Materials Team performed off-site air monitoring to measure the 
concentration of toxic methyl mercaptan outside of the DuPont fence line. Harris County’s instrumentation did 
not detect methyl mercaptan in the air (Section 4.8.4). 

At 10:07 am—seven hours after the release began—DuPont activated the methyl mercaptan tank emergency 
isolation valve to isolate the methyl mercaptan storage tank completely from the leaking process piping (Section 
4.6). 

Between 11:15 am and 11:55 am, during the sixth ERT entry into the manufacturing building, Operator 1 was 
found unresponsive in the north stairwell of the manufacturing building. The coroner later determined that 
Operator 1 had died from asphyxia and acute exposure to methyl mercaptan. 



Intense smell" observed 
at 6:14 am 


"Strong" odor observed at 
6:30 am on highway 225 


DuPont manufacturing 
building methyl 
mercaptan release point 


Figure 8. Locations Where a Sheriffs Sergeant Reported Strong Methyl Mercaptan Odor During the Incident. Source: Google Earth, with 
annotations by CSB. 
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3 Delayed Awareness of Toxic Chemical Release by Operations 

Highly toxic methyl mercaptan was released into the manufacturing building for about 40 minutes before 
operations personnel in the control room realized the extent of the emergency in the building, and for more than 
six additional hours before the release was fully controlled. The CSB identified factors that led to this delay in 
recognizing a major chemical release, including: 

1. The Board Operator was focused on process equipment high-pressure events that he believed 
were critical. Operations personnel became aware of the high-pressure events when insecticide 
manufacturing equipment venting into the waste gas vent header began to exhibit high-pressure 
alarms. At this point, operations personnel shifted their attention from the problem of plugging in 
the methyl mercaptan feed system to the current problem of high pressure in the waste gas vent 
header piping to the NRS incinerator. DuPont La Porte operations staff did not correlate the high- 
pressure problem with the troubleshooting efforts to unplug the methyl mercaptan feed piping 
through hydrate dissociation. Rather, they attributed the high-pressure events to the routine problem 
of liquid accumulation in the waste gas vent header piping. The Board Operator directed personnel 
to help troubleshoot the high-pressure problem [1, p. 28]. The operating pressure of various pieces 
of process equipment inside the manufacturing building, however, continued to increase, in some 
equipment exceeding the high-scale detection limits of process instrumentation. The Board 
Operator was concerned about the potential for equipment overpressure and the release of toxic 
chemicals to the atmosphere outside the manufacturing building. Even though methyl mercaptan 
detectors were beginning to alarm, the Board Operator either was unaware of them or had 
normalized them, not realizing the alarms were alerting him that a significant release had started to 
occur inside the building. Unaware that a significant methyl mercaptan release had begun, the 
Board Operator remained focused on controlling the high pressure he was observing inside the 
equipments 

2. Lannate®Unit personnel accepted methyl mercaptan releases and the associated alarms as 
normal because of methyl mercaptan’s low odor threshold, 13 a history of frequent alarms, and 
a lack of hazard recognition that methyl mercaptan could be lethal. Methyl mercaptan is a 
highly toxic chemical, but its odor can be detected at very low concentrations that are not 


a Although the Board Operator acknowledged the methyl mercaptan alarms on the control system during the incident, afterwards he did 
not recall that any methyl mercaptan detectors inside the manufacturing build had alarmed. 

b Odor threshold, in general, is the lowest concentration of a gas or other material’s vapor that can be detected by odor. Odor threshold 
values are not fixed physiological parameters or physical constants but instead statistical points representing the best estimated value 
from a group of individual responses [112, p. 2]. The odor threshold for methyl mercaptan is approximately two parts per billion (2 ppb). 
However, olfactory fatigue is known to occur with methyl mercaptan, causing the exposed person no longer to be able to detect the 
chemical by smell. As a result, odor may not provide adequate warning of hazardous concentrations [80, p. 1]. 
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considered a health risk to peopled Additionally, the Lannate® Unit used methyl isocyanate (MIC) b 
and chlorine, 0 which are generally accepted as being more hazardous (toxic) than methyl 
mercaptan. d As a result, even though Lannate® Unit personnel were trained on methyl mercaptan 
toxicity hazards, 0 personnel at the site became accustomed to smelling methyl mercaptan daily 
without experiencing negative health effects, leading workers to become less wary of methyl 
mercaptan leaks and the risks associated with them. According to one DuPont worker, there was a 
perception that methyl mercaptan (which workers called “MeSH”) was not dangerous: 

And I smell MeSH all the time ... but it never ... I smelled MeSH, but I 
never felt I couldn’t breathe. Like whether it’s, there’s—whether it’s a 
small leak or anything, it just never—I didn’t think MeSH was that 
dangerous. I thought it, you know, but it is. 

During the troubleshooting efforts before the major release began, smaller releases of methyl 
mercaptan had caused the site to have a strong odor of methyl mercaptan. Therefore, when the 
major release began, site personnel did not realize there was a major release, in part because they 
were accustomed to smelling the chemical. 

3. Personnel were not wearing personal methyl mercaptan detectors. DuPont La Porte had some 
personal methyl mercaptan detectors available, but they were never issued to operators to wear in 
the field. Such detectors could have warned Operator 2, Operator 3, and Operator 4 (personnel who 


a Methyl mercaptan gives off a smell like rotten cabbage. It can be smelled at only 2 parts per billion [80, p. 1]. OSHA’s permissible 
exposure limit, however, is 10 parts per million, which is 5,000 times the minimum concentration that can be smelled. The low odor 
threshold of mercaptans makes them useful as fuel gas odorants [80, p. 2]. 

b MIC is a raw material used in the production of insecticides at La Porte, including the Lannate® process. The 1984 MIC release at the 
Union Carbide insecticide plant in Bhopal, India, that killed thousands of people is an example of the extremely toxic properties of MIC 
[148]. For more information, see Reflections on Bhopal after Thirty Years [148]. 

c DuPont’s corporate standard for the management of highly toxic materials identifies both methyl mercaptan and chlorine as highly 
toxic. DuPont considers a material to be highly toxic if it is handled, stored, or shipped in a sufficient quantity that a credible event could 
result in a concentration of Emergency Response Planning Guidelines (ERPG)-3, and if it has a Substance Hazards Index (SHI) greater 
than or equal to 4,000. This level “is the maximum airborne concentration below which nearly all individuals could be exposed for up to 
1 hour without experiencing or developing life-threatening health effects.” Emergency responders use ERPG-1, -2, and -3 concentration 
data to determine how to protect the public [167]. DuPont determines the SHI using vapor pressure and ERPG-3 data for each chemical. 
Using this approach, DuPont derived an SHI of 19,855 for methyl mercaptan and 385,197 for chlorine. 

d Methyl mercaptan’s threshold quantity (5,000 pounds) that presents the potential for a catastrophic event, under PSM, is larger than that 
of chlorine (1,500 pounds) or MIC (250 pounds), making it less hazardous than either of the other two chemicals ( 29 C.F.R, § 1910.119. 
Appendix A ). 

e DuPont La Porte used computer-based training to communicate hazards about methyl mercaptan (i.e., to perform hazard 
communication, or HAZCOM), consisting of methyl mercaptan hazard information and a quiz. The information gives some of the toxic 
exposure limits for methyl mercaptan. Additionally, the training details that gross exposure can result in death, but it does not specify the 
value at which the chemical is immediately dangerous to life and health. The training advises workers to use at a minimum an SCBA 
when responding to a methyl mercaptan alarm, and not to use smell to detect leaks because methyl mercaptan can cause olfactory fatigue, 
causing anyone exposed to it to stop perceiving an odor within minutes. If there is a leak, personal protective equipment (PPE) is 
supposed to be upgraded. Upgraded PPE also applies to line breaking, and it includes a chemical suit with taped sleeves and cuffs, 
chemical hood, chemical boots, chemical gloves, and an SCBA. 
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initially responded to Operator 1 ’s distress call) of the high methyl mercaptan concentration inside 
the manufacturing building. 

4. DuPont La Porte did not have audible or visual alarms on or in the manufacturing building to 
alert field personnel of a methyl mercaptan release automatically. DuPont La Porte relied on 
verbal communication of alarms, which automatically displayed on a continuously manned control 
board. 

The delay in recognizing this event as a major toxic chemical release that was becoming a deadly concentration 
of methyl mercaptan inside the building contributed to the response of Operator 2, Operator 3, and Operator 4 to 
Operator 1 ’s distress call without respiratory protection. According to DuPont La Porte’s Lannate® emergency 
planning and response manual, if a sensor detected a methyl mercaptan leak and initiated an alarm, personnel 
were required to notify a shift supervisor, sound a plantwide fume release alarm, and wear appropriate PPE 
(including SCBA) during any attempts to stop the leak. The manufacturing building, however, including the 
building’s overall construction, detectors, and alarms, was not designed such that personnel could be readily 
notified of a major chemical release in the manufacturing building. Without being made aware of the major 
chemical release inside the building, Operator 2, Operator 3, and Operator 4 entered without respiratory 
protection. As a result, Operator 2 was killed by methyl mercaptan exposure, and Operator 3 and Operator 4 
were exposed to dangerous concentrations of methyl mercaptan. 

Guidance to Industry 

It is crucial that workers understand when an emergency is occurring. OSHA’s Hazardous Waste Operations 
and Emergency Response (HAZWOPER) standard requires that an emergency response plan address emergency 
recognition and prevention.* For this standard to be effective, companies should ensure that their systems 
associated with emergency recognition and prevention, such as alarms and training, can inform workers of 
hazards and emergencies. 

For example, audible or visual alarms can automatically relay to personnel in the field information about a 
hazardous condition—such as a release of a toxic chemical. Systems like those implemented at DuPont, on the 
other hand, where alarms displayed only on an operator’s control board and still needed an operator to verbally 
communicate alarms, have inherent potential delays. The Center for Chemical Process Safety’s book 
Continuous Monitoring for Hazardous Material Releases provides guidance on the use of such alarms: 

There are occasions when process equipment must be located indoors due to weather-related or 
quality control issues. Combustible [and toxic] gas detection should be provided in these 
buildings.... This detection should be configured to: 

• Send an alarm signal to a continuously manned location; 


a 29C.F.R. § 1910.120 (q)(2)(iii) (Feb. 8, 2013). 


FINAL COPY 


Page 30 






U.S. Chemical Safety and 
Hazard Investigation Board 


Toxic Chemical Release at the 
DuPont La Porte Chemical Facility 

La Porte, Texas | Incident Date: November 15, 2014 | No. 2015-01-l-TX 


• Activate visible and audible alarm devices on the exterior of the building at each 
entranceway and within the structure. The devices within the structure should be 
configured using the guidance for fire alarm devices, as provided in NFPA 72, National 
Fire Alarm and Signaling Code®; and 

• Include a local means of silencing the alarms [6, pp. 63-64]. 

Training is another important way to address emergency recognition and prevention. Under OSHA’s Hazard 
Communication (HAZCOM) standard, companies are required to provide information to employees about the 
hazardous chemicals that they may be exposed to at work, including through training.* 1 Companies should 
ensure that, in addition to having access to chemical information, employees understand the hazards of all 
chemicals they are working with and may be potentially exposed to if there is a release. In cases of multiple 
hazardous chemicals, such as MIC, chlorine, and methyl mercaptan, it is important that companies effectively 
train workers on the hazards of each chemical. This training is important for workers to help ensure they have a 
working knowledge of chemical hazards. 

Working knowledge of the hazards of all chemicals they are working with and may be potentially exposed to if 
a release occurs can improve employees’ recognition of emergency conditions and help them prevent major 
accidents in the manner that an emergency response plan intends. 

4 Emergency Response Operations 

On the night of the incident, the Board Operator’s request for the emergency response team (ERT) to come to 
the scene triggered the start of emergency response operations. From this initial request for ERT aid to the final 
response activities, the La Porte site’s emergency response efforts were characterized by miscommunication, 
disorganization, and a lack of situational awareness. The following key emergency response weaknesses are 
discussed in this section: 

• Based on DuPont La Porte’s emergency response plan, emergency response personnel relied on the 
expertise of the shift supervisor, who was the designated process coordinator. The Shift Supervisor, 
however, was a victim of the incident, and no one else on the shift b was designated to backfill the role of 
process coordinator. This gap led to weaknesses in several aspects of the emergency response 
operations (Section 4.2), including the initial assessment of the problem and of the resources needed for 
an effective response. 


a 29 C.F.R. $ 1910.1200 (bVl) (Feb. 8, 2013). 

b The Lannate® Unit’s emergency planning and response manual designated a primary and secondary backup for the process coordinator. 
These backups, however, were not on-site during the evenings and weekends, including when the incident occurred on November 15, 


2014. 
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• There was a delay in ERT deployment and readiness to respond to the release, due to both a 
misunderstanding of the type of emergency and the failure of an ERT mini-pumper truck that stored 
SCBAs to start (Section 4.3). 

• Searching for the missing workers put the ERT responders at high risk. ERT responders entered a 
hazardous and potentially explosive atmosphere without performing air monitoring. Additionally— 
unbeknownst to them—they entered an area of the manufacturing building that DuPont La Porte had 
previously identified as a collapse risk in the event of an explosion (Section 4.4). 

• DuPont La Porte’s emergency planning and response manual lacked a building map or floor plans to aid 
emergency responders in navigating the manufacturing building. As a result, the ERT experienced 
difficulties navigating the manufacturing building while searching for a missing operator; they resorted 
to assigning unit operators, including the Board Operator, to draw maps of the building to help guide 
them. This assignment diverted the Board Operator’s attention from other critical tasks, such as 
viewing process data on the control room computer screen to try to identify the source of the release 
(Section 4.5). 

• The methyl mercaptan release was not controlled until three hours after it began. Personnel did not 
evaluate process data to determine the cause of the release until hours into the response efforts. 

Analysis of process data from the methyl mercaptan storage tank earlier during the release may have 
revealed that the methyl mercaptan storage tank level was continually dropping and that isolating the 
tank could stop the release (Section 4.6). 

• Emergency responders established a hot zone that was not clearly marked or communicated, thereby 
allowing an operator to be potentially exposed to a dangerous concentration of methyl mercaptan when 
tasked to assist the ERT (Section 4.7). 

• The ERT underestimated the quantity of toxic methyl mercaptan released. Because DuPont La Porte 
lacked fence-line monitors and the ERT did not conduct air monitoring to determine the concentration 
of methyl mercaptan leaving the site, the ERT did not have accurate values to use in its dispersion 
model. Instead, ERT members estimated a small quantity of methyl mercaptan based on verbal 
descriptions of the release’s downwind odor. As a result, the incident command did not issue warnings 
to the community surrounding the La Porte facility to take protective actions from the possibility of 
toxic concentration of methyl mercaptan exiting the site during the release. Furthermore, because air 
monitoring had not occurred during the release, neither DuPont La Porte nor the CSB can pinpoint the 
exact methyl mercaptan concentration that left the site, or what the potential health risk was to the 
public, if any (Section 4.8). 
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4.1 ERT Background 

DuPont was originally the sole operator of the La Porte site. In recent years, however, DuPont had sold portions 
of the operations and leased its facilities to other companies, including Kuraray a and Invista. b Kuraray, Invista, 
and DuPont formed a consolidated ERT at the site, managed by DuPont but jointly staffed by members of the 
three companies. 0 All of the ERT members had other primary jobs for one of the three tenant companies (such 
as unit operators), and they responded as ERT members when alerted during emergencies. In its 2012 Risk 
Management Plan, DuPont La Porte stated that it used the National Incident Management System (NIMS) to 
systematically manage safety, tactics, strategy, personnel, equipment, and logistics, and to work seamlessly with 
any responding departments and agencies [7]. d The site’s ERT was staffed by about 60 employees and had the 
following structure: 

• Incident Command Organization: 2-4 trained incident commanders on each shift 

o Training: National Pro Board Certified 0 as Fire Service Instructors (based on National Fire 
Protection Association, or NFPA, 1041 competencies), and Advanced Exterior Fire Fighters, 
Interior Structural Fire Fighters, and Industrial Fire Brigade Leaders (based on NFPA 1081 
competencies) 

• Fire Brigade Members: 12 members on each shift 

o Training: National Pro Board Certified as Advanced Exterior Fire Fighters and Interior 
Structural Fire Fighters (based on NFPA 1081 competencies) 

• Emergency Medical Services: 2-3 members on each shift 

o Training: Texas Department of State Health Services-Certified Emergency Medical 
Technicians (EMTs), Basic and Intermediate Training 

• Rescue Technicians: 3-5 members on each shift 

o National Pro Board Certified in Rope, Confined Space, and High Line Rescue (based on 
NFPA 1006 competencies) 


a Kuraray is a chemical company that specializes in functional materials [169]. 

b Invista is a subsidiary of Koch Industries, Inc., that manufactures nylon, spandex, polyester, and specialty materials. 
c Post-incident, on July 1, 2015, DuPont La Porte’s performance chemicals business unit was spun off to Chemours [107], [108, p. 35]. 
Chemours also provides ERT members to the La Porte site. 

d According to the U.S. Federal Emergency Management Agency (FEMA) , “NIMS provides a common, nationwide approach to enable 
the whole community to work together to manage all threats and hazards. NIMS applies to all incidents, regardless of cause, size, 
location, or complexity” [132]. 

e The National Board on Fire Service Professional Qualifications (aka the Pro Board) is an accreditation body in the fire service training 
community. It accredits fire service training organizations, which in turn certify emergency responders to specific levels of training and 
competency in accordance with professional qualification consensus standards developed by the National Fire Protection Association 
[97]. 
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• HAZMAT Technicians: most ERT members 

o Training: National Pro Board Certified (based on NFPA 472 competencies) 

Although ERT members were trained to perform emergency response functions, they were not trained on the 
specific hazards of each unit because there were many units within the three companies that processed various 
chemicals with different hazards. The La Porte site attempted to bridge this gap by designating a technical 
liaison position called the “process coordinator” to provide chemical hazard and unit-specific information about 
each of the processes to the ERT during an emergency. This position, along with the emergency operations 
center coordinators, was intended to play a critical role in interfacing with and helping to develop and execute 
emergency response actions with the ERT incident commander. 

4.2 Process Coordinator Was Missing 

The DuPont La Porte’s emergency response plan required the appointment of a shift “process coordinator” from 
each unit to assist the incident commander in providing technical knowledge specific about their unit. The 
emergency response plan defined the process coordinator as “the area emergency response director of the shop, 
warehouse, office building, or process unit involved in the incident who is responsible for developing an action 
plan with the Incident Commander and directing area resources.” The process coordinator was responsible for 
assisting the incident commander in several tasks during emergencies (see Figure 10), including the following: 

1. Communicating (by radio) with the ERT’s incident commander and the site’s emergency operations 
center, as the operations technical liaison 

2. Determining the source and size of chemical leaks (see Figure 9) 
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CRITICAL RELEASE INFORM ATION CHECKLIST 

! * When a fume alarm is called in. the production shift supervisor for the source area must rapidly collect information about 
the reported re Lease. As best as he can, he must determine: 

/ Has there actually been a release? 

^ What is the released chemical? 

V What is the source of the release? 

S W hat is the magnitude of the release? 

V Has the release left the area? 

S When docs an all-dear condition exist? 

J What is stale of release (solid, liquid, or gas)? 

2, Typical question which the Process Coordinator (PC) might ask in order to determine the above include: 

^ Information called in: W hat was seen 11 W'here was it seen? W hat was smelled'* W here on the plant was it smelled? 
/ Wind direction? 

S W ind Speed? 

v W'here is the source of the release in the area? 

S What is the size of the leak? How j long did it last? Or. how big was the spill? 

J Are there continuing reports of aenal fumes, visible cloud, etc,? 

^ W hat do air samples in the area show'* 


Figure 9. Responsibilities of the Process Coordinator (Production Shift Supervisor). In the Lannate® Unit's emergency 
planning and response manual, DuPont La Porte provided this checklist for a process coordinator to use to gather 
information. Source: DuPont. 

3. Deciding whether the site needs to perform off-site air monitoring 

4. Deciding whether to evacuate the unit 


FINAL COPY 


Page 35 











U.S. Chemical Safety and 
Hazard Investigation Board 


Toxic Chemical Release at the 
DuPont La Porte Chemical Facility 

La Porte, Texas | Incident Date: November 15, 2014 | No. 2015-01-l-TX 


AREA RESPONSIBILITY 

The disaster Organization described below shall be activated immediately on sounding of the disaster signal. 


POSITION IIOI,HER 


RESPONSIBILITY 


Process Coordinator 

✓ 

Direct all activities in LANN ATE 1 f API 

AG Shift Leader 

✓ 

Determine when and if to evacuate 

(LANNATE 1 /API the 


LANNATEVaPI area 

afleclcd area) 

OR AS BACKUP 

Primary - 

✓ 

Maintain communication with HOC 

LANNATE/AAO/MIC 

Area Specialist 

Secondary API Area 

V 

Direct Personnel accounting in 

Specialist 


LANNATEVAPI area 


✓ 

Determine potential hazards and begin 


✓ 

control procedures 

Advise other areas of situation and hazards 


✓ 

via yellow* phone 

Contact Emergency Operations Center to 



inform of Position Holder Identity. 


RADIO 

Position holder's radio 


Figure 10. A Section from the Lannate® Unit's Emergency Planning and Response Manual. It details the process 
coordinator's role during an emergency. Source: DuPont. 

As with most shifts, the Lannate® area process coordinator on the night of the incident was the Shift Supervisor. 
The Shift Supervisor in this case, however, was a victim of the toxic chemical release, and DuPont La Porte had 
not designated an on-site backup process coordinator for this shift. a As a result, these important functions were 
either performed in a disorganized manner by other operations personnel or never performed at all. 


In DuPont’s emergency response critiques conducted after the incident, emergency response personnel 
communicated the following: 

- “Weakness: Loss of area technical expertise led to confusion and lack of communication about the 
process. Personnel that would have staffed the technical specialists’ positions ... were victims.” 

- “What are contingency plans? If team leader or subject expert are not available, how is that handled?” 


a The primary and secondary backup coordinator noted in Figure 10 were day shift employees and were not on-site at the time of the 
incident. 
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Guidance to Industry 

Specific technical knowledge from process unit experts—including technical and operations personnel—can be 
invaluable to the incident commander in an emergency at a chemical processing facility. The Hazardous Waste 
Operations and Emergency Response (HAZWOPER) standard identifies persons who can provide this 
information as specialist employees. a Companies need to ensure that these individuals are preidentified as 
technical support personnel and to provide backup capability for all situations in the event the primary technical 
support personnel are unavailable. 

The emergency response plan can address how technical and operations personnel are integrated into emergency 
response roles—the HAZWOPER standard requires that the emergency response plan address “personnel roles, 
lines of authority, training, and communication.” 15 When developing an emergency response plan, companies 
should also consider the nature and extent of duties designated to particular people to ensure they can reasonably 
carry out those duties during an emergency. 

One way companies can ensure that a backup is available during a shift is to have a recall list that identifies 
alternates who can provide technical support. The Center for Chemical Process Safety (CCPS) gives the 
following guidance in its book Guidelines for Technical Planning for On-Site Emergencies'. 

Technical support consists of personnel within the organization and outside emergency response 
groups. Technical support personnel within the organization include engineers, chemists, 
operators, maintenance personnel, and managers having special knowledge of process operations, 
emergency systems, building plans and equipment layout, and hazardous materials present. A 
technical support team consisting of these experts or others with similar qualifications will 
provide the incident commander with a pool of knowledge to draw on during emergencies. 
Technical support team members should be placed on the recall list with designated alternates 
in the event team members are directly involved with the emergency or are not available [8, pp. 
283-284] (emphasis added). 

Another valuable tool that an emergency response team can use is a checklist. As suggested by CCPS, 

Planners should develop emergency action checklists to augment the emergency plan by 
providing memory joggers for actions. Action checklists are concise reminders to personnel of 
key actions that need to be undertaken [8, pp. 158-159]. 


a The HAZWOPER standard defines specialist employees as “employees who, in the course of their regular job duties, work with and are 
trained in the hazards of specific hazardous substances, and who will be called upon to provide technical advice or assistance at a 
hazardous substance release incident to the individual in charge”; it further specifies that they “shall receive training or demonstrate 
competency in the area of their specialization annually” ( 29 C.F.R. § 1910.120 (g)(5) ). 
b 29 C.F.R. § 1910.120 
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A company can develop these checklists in the incident response planning stage and use them during 
emergencies to ensure proper performance of important emergency response tasks like those DuPont assigned to 
the process coordinator, even in scenarios in which the primary assignee is unavailable. 

4,3 Delay in ERT Readiness to Search for Missing Workers 

It took 35 minutes from the request for ERT assistance for the La Porte ERT to initiate the first entry into the 
manufacturing building to search for the missing workers. Discussed below, miscommunication, the lack of a 
process coordinator, and inadequate emergency preparation by DuPont all contributed to the ERT’s delayed 
response. 

4.3.1 Call for ERT Response 

When the Board Operator made his call for ERT assistance over the intercom system, he stated, “We need 
rescue people, and there’s people missing.” To the ERT, rescue specifically meant retrieval of a person from an 
area, so the team brought to the scene only technical rescue gear (e.g., ropes and harnesses). As discussed in 
Section 2.2, ERT members realized upon arrival that contrary to their presumption, there was a chemical release 
and they needed additional PPE. 

DuPont provided the CSB with a May 2014 slide presentation for new employees showing the structure of the 
ERT and how to request assistance from the ERT. The presentation detailed the differences in response groups 
(fire brigade, EMT, rescue, and fume release). While some operations personnel may have understood the 
organization of the ERT, a key problem at the time of the request for the ERT during the incident under study 
was that the incident was not yet fully understood. As a result, important details could not be communicated in 
the initial ERT call. In addition, DuPont lacked an on-site backup process coordinator to communicate and 
coordinate response operations with the ERT. 


In one of DuPont’s emergency response critiques conducted after the incident, emergency response 
personnel communicated the following: 

- “There was confusion on who was to respond.... For [a request for] EMT, only EMT responds. 
For [a request for] rescue, only rescue responds, and for [a request for] ERT (fume/fire) then 
everyone responds.” 

- “There was a communication problem initially. [We attempted] radio communication, not 
realizing that [the] leader had been lost. Operators were lost. No one [in the unit] knew how ERT 
worked.” 
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Guidance to Industry 

Plant emergency procedures should clearly define the alerting and notification process for different types of 
plant emergencies. These procedures should also include guidance for situations in which initial information to 
effectively assess the nature of the problem and the amount and type of ERT resources required is incomplete. 

4.3.2 ERT Mini-Pumper Truck Not Operational 

When the ERT learned that the incident involved a chemical release, the Incident Commander asked ERT 
members to come to the scene with bunker gear and SCBAs. ERT members stored their SCBAs on a mini¬ 
pumper truck. When an ERT member tried to start this mini-pumper truck to bring the gear to the site where it 
was needed, a the vehicle did not start because of multiple mechanical malfunctions. An October 2, 2014, work 
order states, “Check[ed] batteries and they were not good, remove[d] and replace[d] with new ones.” Replacing 
the batteries, however, did not fully repair the truck, which failed to start at the time of the incident, impairing 
the effectiveness of the ERT response. After the incident, DuPont La Porte personnel replaced the truck’s 
alternator, battery cable, and belts to make it operable. Although the pumper truck was a critical piece of 
emergency response equipment, DuPont La Porte did not adequately maintain it before the incident to ensure its 
availability during an emergency. 


In DuPont’s emergency response critiques conducted after the incident, emergency response 
personnel communicated: 

- “Opportunity: Exercise and inspect the emergency services apparatus on a more frequent basis. 
Perform maintenance in a timely fashion to ensure the functionality and reliability.” 

- “Weakness: I had gear and equipment that didn’t make it to the scene. We get in a comfort zone 
and [think] it won’t happen to us, and it did.” 


Since the mini-pumper tmck holding SCBAs could not come to the scene, the ERT assigned an operator to 
retrieve additional SCBAs in the Lannate® Unit for the ERT to use. b Retrieving the SCBAs may have exposed 
the operator to a high methyl mercaptan concentration because these SCBAs were downwind of the methyl 
mercaptan release point (Section 4.7). 


a The pumper tmck was a Ford F-450 Mini Pumper. 

b The SCBAs on the tmck were rated for 60 minutes. Initially, the ERT had to use SCBAs from the area that were rated for 30 minutes. 
Later on, 60-minute SCBAs were transported to the scene. 
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Guidance to Industry 

Under the HAZWOPER standard, an emergency response plan must address PPE and emergency equipment, a 
such as the SCBAs and mini-pumper truck. It should also contain information on how to ensure that PPE and 
emergency equipment are always functional. 

Even though industrial facilities may call upon emergency response vehicles infrequently, it is essential that 
these vehicles operate as intended when needed. To ensure emergency vehicle reliability, companies need to 
develop and apply regular maintenance schedules. The National Fire Protection Association’s Standard for the 
Inspection, Maintenance, Testing, and Retirement of In-Service Emergency Vehicles (NFPA 1911) requires 
weekly visual and operational checks for emergency vehicles. b Annex C of NFPA 1911, titled Developing a 
Preventive Maintenance Program , also provides guidance and example checklists to use when performing 
preventive maintenance on emergency vehicles [9, pp. 79-99]. 

4.4 The Search for Missing Workers Was High Risk 

When the HAZMAT-trained ERT members and the necessary PPE arrived at the scene of the release, the 
emergency response still faced three major issues: 

1. The ERT initially did not use air monitoring equipment to identify whether the building had an 
explosive atmosphere. 

2. Emergency responders did not know the locations of the missing workers. 

3. Emergency responders were not familiar with the layout of the building and processes. 

While no emergency responders were injured, operations under these conditions exposed responders to 
increased risk. 


a 29 C.F.R. § 1910.120 (qX2Xxi) . 

b The 2017 version of NFPA 1911 states, “A visual and operational check of the apparatus shall be performed within 24 hours of a run or 
at least weekly” [9, p. 17]. The 2012 version of NFPA 1911, which was the applicable standard at the time of the incident, states, “An 
operational check and visual check of the fire apparatus shall be performed on a daily/weekly basis to ensure the operational readiness of 
the unit” [98, p. 13]. 
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4.4.1 Entry into Potentially Explosive Atmosphere 

During the incident, Harris County emergency responders used a QRAE monitor * * 3 * * and a MultiRAE monitor b 
during their building entries. These monitors can inform personnel whether the environment is explosive or 
immediately dangerous to life or health (IDLH). Colorimetric gas detection tubes (e.g., Drager-Tubes) can also 
measure gas concentrations during emergencies. 0 Air monitoring by ERT personnel is a critical element in 
employing a risk-based emergency response operation^ Failure to conduct air monitoring increases the 
potential for significant risks to emergency responders, employees, and the public, and it can lower the 
probability of a safe and effective emergency response. Emergency responders typically use portable air 
monitors to measure gas concentrations during entries into hazardous areas. 

During the ERT’s initial entry into the manufacturing building to search for the missing workers, ERT members 
did not use air monitoring equipment to characterize the building atmosphere. DuPont La Porte had assigned 
operations personnel to maintain and control air monitoring equipment within each of their business units to be 
made available to the incident commander or the process coordinator during emergencies. The DuPont La Porte 
emergency response plan identifies the incident commander as being responsible for directing personnel 6 * to 
conduct air monitoring downwind of the release. 

There was a delay in air monitoring inside the building, and the ERT could not determine if there was an 
explosive atmosphere (methyl mercaptan is a flammable gas) f during the initial entry into the manufacturing 
building. 8 Without this monitoring, the ERT may have unknowingly entered an explosive atmosphere. Later, 
the ERT entered the building with other external emergency response groups that had air monitoring equipment. 
The potential for a methyl mercaptan explosion in the building posed a serious hazard to emergency responders, 
due to both the inherent explosion effects (e.g., overpressure, shrapnel) and the structural collapse risk (Section 
4.4.3). 


a The QRAE monitor is a four-sensor monitor specifically manufactured by RAE to continuously monitor, for example, oxygen, 

percentage of lower explosive limit, and toxic gases [124]. 

b The MultiRAE monitor, specifically manufactured by RAE, has up to six gas sensors to continuously monitor, for example, percentage 

of lower explosive limit (LEL), oxygen, and toxic gases [123]. To obtain percentage LEL, this type of detector is typically calibrated 
using methane, and the user multiplies the percentage LEL reading by a given correction factor to obtain the percentage LEL of the 

chemical of interest [84]. 

6 “Drager-Tubes are glass vials filled with a chemical reagent that reacts to a specific chemical or family of chemicals. A calibrated 100 
ml sample of air is drawn through the tube. If the targeted chemical(s) is present, the reagent in the tube changes color and the length of 
the color change typically indicates the measured concentration” [125]. 

d A risk-based emergency response operation is an approach that sets policy and programmatic priorities based upon measured levels of 
risk to lives, property, and the environment [165, p. 6]. 

6 Personnel can be either mechanics, operators, or emergency response personnel who are trained on air monitoring equipment and 
familiar with the area. 

f 

Methyl mercaptan is flammable at concentrations between 3.9 percent and 21.8 percent by volume [50]. 

8 At approximately 7:30 am, the ERT was pulled out of the building to resolve issues with PPE because it was determined that methyl 
mercaptan posed a flammability risk. 
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Guidance to Industry 

Entering a structure with an unknown environment may pose additional risks to emergency responders. For 
example, it may have the potential to be explosive, as in the situation at DuPont La Porte. Recognizing the 
issues associated with uncharacterized environments, the HAZWOPER standard requires the individual in 
charge (here, the incident commander) to identify to the extent possible “all hazardous substances or conditions 
present and shall address as appropriate site analysis, use of engineering controls, maximum exposure limits, 
hazardous substance handling procedures, and use of any new technologies.” a Additionally, the HAZWOPER 
standard also identifies a safety officer as an individual who assists the incident commander in identifying these 
hazards 13 and makes safety decisions surrounding them. c This standard gives the incident commander the 
responsibility of determining the risks associated with the emergency response using available personnel and 
tools (emergency equipment and PPE). Before directing emergency response activities, the nature of the 
hazards needs to be identified and characterized to determine the appropriate actions to be taken. 

Incident commanders, safety officers, and other emergency response personnel can look to industry guidance to 
help them determine the safest course of action in a given situation. For example, NFPA 472, Standard for 
Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, gives illustrative 
example conditions—including those conditions present during the DuPont La Porte incident—in which NFPA 
recommends prohibiting emergency response personnel from entering the hot zone. They include, among other 
conditions: 

• flammable or explosive atmosphere present and 

• insufficient personnel to perform tasks [10, p. 100]. 

One method emergency responders can use to characterize unknown environments is air monitoring. To ensure 
that emergency responders can perform air monitoring of hazardous atmospheres, industrial facilities should 
provide ERT members with their own air monitoring equipment and train them in how to operate it (e.g., NFPA 
472 requires that hazardous materials technicians be able “through detection, monitoring, and sampling,... [to] 
verify the presence of hazardous materials... [and] determine the concentration of hazardous materials in the 
atmosphere” [10, pp. 42-43]). 

If facilities choose to assign maintenance and storage of portable air monitoring equipment to non-ERT 
members, the company should also ensure that the ERT can readily locate and access the stored equipment. 


a 29 C.F.R. $ 1910.120 (4X3)00 . 

b “The individual in charge of the [incident command system] shall designate a safety officer, who is knowledgeable in the operations 
being implemented at the emergency response site, with specific responsibility to identify and evaluate hazards and to provide direction 
with respect to the safety of operations for the emergency at hand” ( 29 C.F.R. § 1910.120 (qX3)(ViiV) . 

c “When activities are judged by the safety officer to be an IDLH and/or to involve an imminent danger condition, the safety officer shall 
have the authority to alter, suspend, or terminate those activities. The safety official shall immediately inform the individual in charge of 
the [incident command system] of any actions needed to be taken to correct these hazards at the emergency scene” (29_CER i _§J910T20 

(aXSXYiii))- 
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4.4.2 No Technology to Locate Missing Workers 

DuPont La Porte did not equip the manufacturing building with technology either to account for the entry of 
personnel into the building or to track their location once inside. The manufacturing building processed highly 
hazardous chemicals—including methyl mercaptan and chlorine—in an enclosed environment. Companies can 
use technology (such as cameras, badges, or chip readers) to track the locations of personnel upon entry into 
high-hazard areas or in the event of an incident. Knowing the location of personnel could help emergency 
responders conduct targeted rescues by allowing them to reach affected personnel quickly and minimize ERT 
member exposure to hazardous environments. 


Guidance to Industry 

Facilities that handle large quantities of flammable or toxic chemicals have a responsibility to monitor high- 
hazard areas, such as DuPont’s Lannate® manufacturing building, for releases and personnel injuries. That 
monitoring capability must be available to emergency response personnel to assess the scope and nature of any 
incident, including possible locations of employees within the area. High-hazard areas should be equipped with 
sufficient monitoring devices, such as detectors, alarms, and surveillance technology, to identify whether there is 
a chemical release (or other type of emergency) and whether personnel are affected. a When surveillance 
cameras are used, companies should consider having the camera feeds go to multiple plant locations, including 
control rooms, plant security stations, and the plant emergency operations center (EOC). 

4.4.3 Unrecognized Manufacturing Building Collapse Hazard 

A 2002 DuPont La Porte facility siting study predicted potential damage to the manufacturing building based 
upon various explosion scenarios. In the analysis of a hypothetical methyl mercaptan explosion on the first floor 
of the manufacturing building, the study listed the “Predicted Building Damage Level” as “Collapse []-Building 
fails completely. Repair is not feasible.” 

Neither DuPont La Porte’s emergency response plan nor the Lannate® Unit’s emergency planning and response 
manual included information from the 2002 study on the potential risk of structural collapse in the event of an 
explosion. DuPont La Porte did not have a system in place to ensure that emergency planning documents were 
updated when site studies, such as a process hazard analysis (PHA), identified relevant information. 
Consequently, the emergency planning documents did not prepare ERT members for the risk that the 
manufacturing building could collapse. 


a According to Sutton, author of Plant Design and Operations , closed circuit television (CCTV) “can help with fire response—not so 
much with the initial detection but in providing information that can help with control of the facility and direction of the emergency 
response team. Cameras can be installed in a fixed position focused on high-risk areas or may permanently scan large areas.... Typical 
locations for CCTV cameras are pump floors in process and oil movement areas, road/railcar loading areas, jetties, and buildings that 
contain process equipment” [85, p. 203]. 
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Although an explosion did not occur and the manufacturing building did not collapse, entry into the 
manufacturing building posed a serious safety risk to members of the ERT during emergency response activities 
following a significant methyl mercaptan release. 

Guidance to Industry 

NFPA 1620, Standard for Pre-incident Planning, states, “The pre-incident plan shall address the structural 
integrity of walls, roofs, and floors” [11, p. 9]. This standard is intended to provide information to the incident 
commander. To help emergency responders become knowledgeable of known unit hazards, companies should 
develop a system to update emergency planning documents when other studies identify pertinent hazards and 
risks. 


4.5 Difficulties Navigating Manufacturing Building 

Many of the emergency responders searching the manufacturing building worked at the La Porte site as 
operators in other units or for other companies located there. Some of these responders, therefore, were 
unfamiliar with the manufacturing building—a four-story building containing a large amount of piping and 
process equipment, dividing walls, multiple stairwells, and an elevator. Figure 11 shows photos taken inside the 
manufacturing building, illustrating the complexity of the layout inside the building. 



Figure 11. Photos of the Interior of the Lannate® Manufacturing Building. Source: CSB. 
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The CSB found that the Lannate® Unit’s emergency planning and response manual did not have a building map 
or floor plan to aid emergency responders in understanding and navigating the manufacturing building during 
the incident. Emergency responders assigned Lannate® Unit operators—including the Board Operator—to draw 
maps of the manufacturing building to assist in the search. The Board Operator informed the CSB as follows: 

They got the big pad ... and had me sit down and start drawing pictures. And [the emergency 
responder] said, “We want it as detailed as you can get.” So, I drew the building, I drew the 
stairwells, I drew the reactors, what reactors were where, you know, and coolers, you know, on 
each floor. That’s what they wanted me to do, draw a description of each floor as well as I could 
... so when they go in, they know where they’re going. They can look, and of course three of 
[the missing operators were] found already, but they never did—at that time, they didn’t know 
where [the fourth missing operator] was.... It took me about an hour and a half to draw stuff, you 
know. 

Seven months before the incident, DuPont La Porte performed a response drill for operators in the Lannate® Unit 
and developed a follow-up action item that “plot plans should be readily available for responder reference” 
(Ligure 12). The CSB found that the drill leader, however, did not assign this action item to specific personnel 
or input the item into the site’s action item tracking system. Consequently, no one took responsibility for the 
action items, and the recommended plot plans were never created. 



KEY LEARNINGS / FOLLOW-UP 

2Q14 RESPONSE DRILL 

-AREA SPECIFIC— 

Crop Protection - Lannate 

Areas of Additional Effort (continued): 

* Plot Plana should he readily available tor responder reference. 

* Add new employees to area personnel accounting rosier. 

Wednesday, April 23, 9:00A 

* Area evacuation coordinator should report status to EOC, 
once arrived at evacuation destination. 

“C” SHIFT 

* Confusion with area evacuation oJ non essential personnel. 


Clarify wlio is to evacuate where and provide for building 
sweep. 

Included Evacuation of Non-essential Lannate Personnel 


Included Participation by Harris County OEM 



Figure 12. Excerpt from an April 2014 Drill Follow-Up. It recommended that plot plans be readily available 
for responder reference. A plot plan was never made for the manufacturing building. Source: DuPont. 


Guidance to Industry 

Although the HAZWOPER standard requires that emergency response plans detail evacuation routes, 
evacuation procedures, safe distances, and places of refuge, it does not specifically require development of plot 
plans. 11 NFPA 1620, Standard for Pre-incident Planning, on the other hand, supports the development of plot 


a 29C.F.R. § 1910.120 (q) (February 8, 2013). 
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plans in complex hazardous environments. The standard establishes criteria for developing “pre-incident plans 
to assist personnel in effectively managing incidents and events for the protection of occupants, responding 
personnel, property, and the environment” [11, p. 5]. It also defines different complexity levels of pre-incident 
plans: (1) Level 1, Basic, (2) Level 2, Intermediate, and (3) Level 3, Comprehensive. NFPA 1620 states, 

Level 3 information is the most detailed level of pre-incident planning and is intended to include 
process hazards and protection schemes, detailed occupancy considerations, room or area layouts , 
and operational features (e.g. ventilation, power) [11, p. 17]. (emphasis added) 

In addition, it is a good practice for site-level emergency responders—and external emergency response 
groups—to be familiar with the layout of enclosed buildings within chemical facilities in the event of an 
emergency. Familiarity with buildings and process areas can reduce recovery time and aid in life-saving rescue 
operations. Periodic drills inside process structures can help familiarize responders with the buildings and 
improve responder navigation during emergencies. a 

To help prepare for emergencies, chemical facilities should do the following: 

1. Develop site maps and plot plans of the facility, including the layout of process buildings. Ensure these 
maps are up-to-date and readily available to emergency responders. 

2. Coordinate regularly scheduled site tours for both plant and external emergency responders to establish 
strong working relationships and help ensure emergency responders are familiar with facility access 
points, hazards, emergency response issues, and site or facility layout. b 

3. Familiarize responders with process structures or buildings to improve responder navigation during 
emergencies by having periodic drills inside them at established, recurring intervals. To enhance 
responder performance, members of an emergency response team should train together, especially in 
situations in which multiple companies are staffing a single team. 


a NFPA 1, Fire Code , Annex D, “Hazardous Materials Management Plans and Hazardous Materials Inventory Statements,” requires 
detailed site, building, and structure drawings. Additionally, facilities are required to have inventory assessments that include chemical 
names and their common names. Annex D is not a requirement of NFPA 1 unless it is specifically adopted [106, pp. 731-740]. 
b NFPA 600, Standard on Industrial Fire Brigades, states, “Facility fire brigade management should maintain a close working relationship 
with all emergency response organizations that could reasonably be expected to respond to the facility during an incident. This 
relationship should include ... an invitation to the emergency response organizations to participate in a pre-fire planning walk-through or 
tour of the facility” [103, p. 19]. 
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4.6 No Analysis of Process Data to Identify Source of Leak 



Methyl Mercaptan 
Emergency Isolation Valve 
(activated 7 hours after 
chemical release began) 






Manufacturing 

Building 


Methyl Mercaptan 


*’ Storage Ta n k 


Figure 13. Location of Methyl Mercaptan Emergency Isolation Valve Relative to Manufacturing Building 
Where Leak Occurred. The emergency isolation valve was not activated until seven hours after the 
release began. Source: Google Earth, with annotations by CSB. 


DuPont La Porte had installed an emergency isolation valve for the methyl mercaptan storage tank. Companies 
often install emergency isolation valves to avoid the need to isolate chemical release points manually during 
large releases of a flammable or toxic chemical; locations for such valves include, for example, points near 
property lines, at the boundaries of process units, or at liquid outlets of vessels containing flammable or toxic 
chemicals. a The installation and use of these valves can help prevent someone from having to enter a flammable 
or toxic atmosphere to stop a chemical release. Even though the methyl mercaptan storage tank had an 
emergency isolation valve, its closure was significantly delayed. 

The release began just after 3:00 am, but 

1. the methyl mercaptan storage tank pump was not turned off until 6:02 am—three hours after the release 
began—significantly reducing the rate of the methyl mercaptan release, and 

2. the methyl mercaptan storage tank emergency isolation valve was not closed until 10:07 am—seven 
hours after the release began—finally isolating the methyl mercaptan storage tank from the process 
(Figure 13). 


a Emergency isolation valves could be designed to (1) close automatically, for example, during an emergency shutdown of a unit; (2) 
close remotely, by manual activation; or (3) be manually closed [81, pp. 123-124]. 
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Earlier performance of these two critical equipment manipulations could have controlled the release much 
sooner. 

The CSB determined that the delay in isolating the methyl mercaptan storage tank from the process occurred for 
two reasons: 

1. Personnel did not recognize the need to close the methyl mercaptan storage tank isolation valve when 
they determined that methyl mercaptan was the chemical being released inside the manufacturing 
building. 

2. No one evaluated process data to determine what was causing the release until hours into the response 
efforts. Had personnel looked at the process data earlier during the release, it should have been clear 
that methyl mercaptan was flowing from the methyl mercaptan storage tank, requiring closure of the 
emergency isolation valve (Figure 14). 



Figure 14. Process Data from November 15, 2014. Data shows that methyl mercaptan was 
abnormally flowing from the methyl mercaptan storage tank. No one analyzed these data during 
the first hours of the incident. Source: CSB graph based on DuPont data. 
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The CSB identified three causes for not analyzing process data earlier during the release: 

1. The Lannate® Unit’s Shift Supervisor (Process Coordinator), who was responsible for determining the 
source of any chemical release and identifying the valves to close to stop the release, had been 
overcome by methyl mercaptan exposure, and there was no designated backup on shift (Section 4.2). 

2. During the chemical release, the Board Operator, who could have analyzed the process data, was 
repeatedly pulled away from monitoring the process to communicate with emergency responders and 
perform tasks such as drawing maps of the building (Section 4.5). 

3. Even though there was a troubleshooting operation going on in the Lannate® Unit before the release, 
there was no technical or engineering support on-site to help the operators if the Lannate® process 
responded abnormally. Site personnel did not contact the on-call DuPont La Porte technical employees a 
during the early stages of the incident for assistance in identifying the source of the methyl mercaptan 
release (Section 4.6). 

Guidance to Industry 

When a process safety incident such as a chemical release occurs, it can be beneficial for technical personnel 
who are not immediately involved in emergency response functions to analyze process data and quickly identify 
the cause, scope, and magnitude of the incident. This analysis will help the company (or incident commander) 
identify needed equipment manipulations to stop or control the incident, such as shutting down equipment or 
closing isolation valves, to mitigate the effects of a release and the threat to responders and the public. In 
Guidelines for Technical Planning for On-Site Emergencies , CCPS provides guidance on the possible 
emergency roles of various plant personnel during an incident [8, p. 161] (Figure 15). 


a 


The DuPont La Porte technical employees were contacted individually throughout the morning by a variety of persons. 
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Possible Emergency Roles 


Functional 

Groups 


Possible Pole 


Engineering Assist in prevention measures, provide technical advice to incident commander 
during emergencies. 

Environmental Determine government notifications, provide advice on preventing environmental 
impacts, communicate with government environmental officials, assist in 
environmental sampling efforts. 

Finance Assist in tracking expenditures and damage assessment; assist other managers. 

Human Provide victim assistance, coordinate with corporate insurance, finance, or risk 
resources management officials. Serve as interface with hospital Provide comfort items. 

LegaI Assist general managers in determining noti ficatart requi rements. Review press 

releases prior to issuance. 

Maintenance Provide staff for emergency teams, provide technical advice on incident mitigation 
measures, assist in prevention activities, evaluate damage following an incident, 
participate in incident investigation. Maintenance can also provide riggers, 
electricians, pipefitters, and other logistical support. 

Medical Provide first aid to victims and support to response team. 

Plant Perform personnel accountability, provide technical advice on shut-down process 

operations equipment Assist in size up. Provide analytical sources. 

Public Coordinate media relations, prepare press releases, 

relations 

Purchasing Assist in obtaining necessary logistics {backup supplies and equipment) to support 

emergency operations. 

Safety and Provide advice to incident commander, provide M5DS and other information to 
i nd ustrial hospitals and physicsans, make notificatton to OSHA or state agencies as required. 

hygiene Monitoring and sampling. Document needs information. 

Sates Provide assi stance to managers, notify customers of potential delivery disruptions 

following an emergency. 

Security Sect)re the facility and incident scene during and following an emergency, make 
notifications, prevent interference of onlookers and media with essential 
operations. 

Utilities’ Maintain or shut down operations as necessary to ensure safety. 


Figure 15. Example Roles for Various Plant Personnel During and after an Emergency. 
Source: CCPS. 


4.7 Inadequate Creation and Control of Hot Zone 

The ERT did not adequately establish, physically mark, or communicate the boundary of the hot zone during the 
early stages of the emergency response efforts. The zone was physically marked only after external emergency 
services groups arrived at the scene. The absence of a clear hot zone boundary as part of the early emergency 
response led to poor incident scene control, including trouble determining who had entered and exited the hot 
zone and whether they were wearing proper PPE. 
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During the incident, the ERT asked an operator who was not an ERT member (Operator 7) to assist the team by 
retrieving SCBAs from the Lannate® Unit. Because the hot zone was not physically defined, and entry/exit 
control points were not staffed and controlled, the operator did not realize the SCBAs were in a potentially 
hazardous location. She entered the hot zone without respiratory protection and, based on the symptoms she 
exhibited, believes she was exposed to a high concentration of methyl mercaptan (Figure 6). 


In one of DuPont’s emergency response critiques conducted after the incident, emergency response 
personnel communicated: 

“Weakness: Visual markers and communication of the control zone boundaries.” 


Guidance to Industry 

The establishment, communication, and control of a hot zone is necessary to help protect plant personnel and 
emergency responders. Under the HAZWOPER standard, an emergency response plan must address “safe 
distances and places of refuge.” a An emergency response plan can provide guidance in determining safe 
distances and places of refuge for different types of emergencies and in effectively communicating these zones. 

Companies can look to voluntary consensus standards for guidance on how to establish hot zones. For example, 
NFPA 472, Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destmction 
Incidents, requires that the hazardous materials safety officer 13 “identify whether the boundaries of the 
established control zones are clearly marked ... and are being maintained” and “verify that each team is 
protected and prepared to perform its assigned tasks by ... verify[ing] whether the selection of PPE and 
equipment is consistent with the site safety and control plan” [10, p. 61]. 

Once personnel establish and communicate a hot zone, they must control entry and exit. HAZWOPER states 
that the incident commander “shall limit the number of emergency response personnel at the emergency site, in 
those areas of potential or actual exposure to incident or site hazards, to those who are actively performing 
emergency operations. However, operations in hazardous areas shall be performed using the buddy system in 
groups of two or more.” 0 These requirements help ensure that emergency response personnel minimize their 
potential exposure to hazards. 


a 29 C.F.R. $ 1910.120 (q)(2yiv) . 

b The hazardous materials safety officer is part of the incident command system and ensures that safe practices are followed during 
hazardous materials incidents [10, p. 58]. 
c 29 C.F.R. § 1910.120 (q¥3Xv) . 
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ERPG Levels 


Emergency Response Planning Guidelines 
(ERPGs) are chemical concentration levels used 
when preparing for and responding to 
emergencies. They are designed to anticipate 
public health effects, not occupational health 
effects, from exposure to airborne chemicals. 

The three ERPG levels are as follows: 

ERPG-3 : The maximum airborne concentration 
below which nearly all individuals could be 
exposed for up to one hour without experiencing 
or developing life-threatening health effects. 

ERPG-3 is a worst-case planning level. 

Exposure to concentrations above the ERPG-3 
level will be lethal to some members of the 
community. 

ERPG-2 : The maximum airborne concentration 
below which nearly all individuals could be 
exposed for up to one hour without experiencing 
or developing irreversible or other serious health 
effects, or symptoms that could impair an 
individual’s ability to take protective action. 

At concentrations above ERPG-2, some members 
of the community may experience significant 
health effects, which could impair them from 
taking protective action. Emergency responders 
often alert the community to take protective 
action in areas susceptible to the ERPG-2 
concentration and above. 

ERPG-1 : The maximum airborne concentration 
below which nearly all individuals could be 
exposed for up to one hour without experiencing 
more than mild, transient adverse health effects 
or without perceiving a clearly defined 
objectionable odor [86]. 


To prevent a similar hazardous situation to personnel assisting 
industrial emergency response teams, companies should ensure 
that emergency response team members are trained (1) to 
physically designate the hot zone, and (2) to communicate the 
location of the hot zone and its entry control points to all 
personnel assisting with the emergency response, including 
operations personnel. 

4.8 Deficiencies in Evaluating Risk to the 
Public 

DuPont La Porte did not effectively evaluate the impact of a 
potential major methyl mercaptan release on members of the 
public. Site personnel had several available methods (discussed 
below) to help identify whether a hazardous concentration of 
toxic methyl mercaptan was traveling off-site. As discussed in 
this section, the emergency responders 

• used a model of the chemical release that had 
inaccurate model inputs, 

• did not use available on-site methyl mercaptan 
concentration data to evaluate the potential for an off¬ 
site release, 

• misinterpreted methyl mercaptan physical property 
data by mistakenly believing methyl mercaptan was 
lighter than air and would not expose people off-site to 
hazardous concentrations, 

• did not adequately communicate to external emergency 
response parties the name of the chemical being 
released, and 

• did not perform air monitoring during the release to 
predict possible off-site consequences. 

Although there was a potential that methyl mercaptan may have 
exceeded ERPG-3 a concentrations outside the fence line (see 
ERPG Levels box), the CSB is not aware of the actual 


a The ERPG values for methyl mercaptan in parts per million are ERPG-1, 0.005; ERPG-2, 25; ERPG-3, 100 [82]. People can typically 
detect methyl mercaptan odor at about 2 parts per billion (ppb) [80, p. 1]. 
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concentrations because timely air monitoring was not performed. Additionally, the CSB is unaware of any 
reported off-site injuries. 

4.8.1 Release Modeling 

The ERT used software called SAFER a to model chemical releases in real time to help identify areas susceptible 
to hazardous concentrations of the chemical being released. Chemical release modeling is commonly used for 
assessing response scenarios during the emergency planning process and can also be used as part of incident 
management activities during a response. Its use is dependent upon having accurate source data, such as the 
chemical release rate. To create an effective model of a chemical release, SAFER needs an estimated chemical 
release rate based on accurate data. 

The Lannate® Unit’s emergency planning and response manual called for the SAFER operator to create a model 
of the release. Because there was no air monitoring information available, the SAFER operator estimated a 
release rate based upon an ERT member’s observations regarding the relative strength of the chemical odor 
outside of the manufacturing building. The SAFER operator informed the CSB as follows: 

Once I found out what the chemical was—methyl mercaptan—I plugged it in [to SAFER] and 
we still didn’t know what kind of release rate we had. So, I went ahead and plugged in 10 pounds 
[per hour] because based on what [they’re] telling me [they] could barely smell anything. I didn’t 
realize it was a significant release. ... So, I just had to plug something in, so I plugged in 10 
pounds an hour release rate. ... We were just guessing at the release rate. 

Using the estimated release rate of 10 pounds per hour, the SAFER software predicted that a hazardous 
concentration of methyl mercaptan would not leave the company property. In part because the software model 
showed the chemical was not hazardous off-site, DuPont La Porte did not notify the authorities to alert the 
community to shelter-in-place or to divert traffic from the nearby Highway 225 (Figure 16). 


a At the time of the incident, DuPont La Porte was using SAFER Real-Time to do its emergency response dispersion modeling. This 
program is no longer supported, and SAFER has transitioned this program to SAFER TRACE [99]. 
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Highway 225, where chemical 
plume was directed and strong 
odor was smelled 


DuPont La 
Porte Facility 


Figure 16. Overhead Image of DuPont La Porte Facility. A plume of methyl mercaptan left the DuPont property in a 
southeasterly direction toward a major highway and residential area. Source: Google Earth, with annotations by CSB. 


Companies should not rely on unsupported data when making critical emergency response decisions, such as 
those affecting workers or the surrounding public and community. Companies are best positioned to determine 
the types of hazards that their processes and chemicals pose. Moreover, in developing emergency response 
plans, companies can develop scenarios for potential releases, which can be an important resource during an 
emergency. The U.S. Department of Transportation’s (DOT) 2016 Emergency Response Guidebookf provides a 


a The 2016 Emergency Response Guidebook is a joint publication of Transport Canada, the U.S. Department of Transportation (DOT), 
and the Secretariat of Communications and Transport of Mexico, with collaboration from Centro de Informacion Quimica para 
Emergencias of Argentina. The guidebook “is primarily a guide to aid first responders in quickly identifying the specific or generic 
hazards of the material(s) involved in the incident, and protecting themselves and the general public during the initial response phase of 
the incident.” It is primarily intended for use in transportation incidents involving dangerous goods [12, p. 358]. 
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format that can be used by companies to guide initial emergency response. a Table 1 in the guidebook provides 
standardized instructions for determining the isolation and protective action distances for small and large spills 
by predicting the size of downwind areas that could be affected by a cloud of toxic gas [12, p. 292]. This 
information is used as initial guidance to determine the size of the public area that should be alerted to take 
protective measures, including evacuation. 

The 2016 Emergency Response Guidebook is intended to be a reference for emergency responders during 
transportation emergency events that could affect the public. It has limitations when it comes to fixed chemical 
facilities. For example, in the guidebook, a large spill is anything greater than 55 gallons, yielding a very wide 
range in spill amounts. On the night of the incident, approximately 2,530 gallons of methyl mercaptan was 
released inside the Lannate® Unit, b which is about 46 times larger than 55 gallons. Even at 55 gallons, the 
guidebook recommends that in the event of large outdoor methyl mercaptan spills at night, emergency 
responders alert people to take protective action within 1.9 miles (3.1 kilometers) downwind of the release [12, 
p. 297]. Figure 17 shows the area to be protected if this guidance had been followed, which includes Highway 
225 and a residential area. If DuPont La Porte had created its own version of a guidebook for release scenarios 
(including release of methyl mercaptan), actions may have been taken to protect the public. 

Following the incident, based on the methyl mercaptan storage tank level decrease, the CSB calculated that the 
methyl mercaptan release rate was closer to 9,000 pounds per hour, much of which was inside the 
manufacturing building—a rate 900 times greater than the dispersion model input. In an earlier study, DuPont 
determined that a leak greater than 4,500 pounds per hour (from an outdoor, elevated source) could result in 
hazardous off-site concentrations (ERPG-3 level) of methyl mercaptan. 0 According to DuPont’s guide for 
consequence analysis, concentrations above ERPG-2 require evacuation of the affected area. No evacuation 
occurred, because DuPont lacked adequate release information to provide to authorities. 


a The CSB has found in several of its investigations that application of the Emergency Response Guidebook may not be appropriate at all 
fixed industrial facilities due to larger quantities of chemicals at fixed facilities, hazardous process conditions, or possible proximity to 
other hazardous chemicals [142, p. 1]. Fixed facilities may find guidance in the Emergency Response Guidebook beneficial in some 
scenarios, but such facilities should also consider other information when conducting emergency response operations, such as equipment 
inventory, site-specific emergency response plans, and company-specific safety data sheets. If a site does use the Emergency Response 
Guidebook as an initial reference early in the release, process data, equipment inventory, and specific site hazards should always be 
evaluated to help determine effective emergency response operations. 

b The amount of methyl mercaptan released is based on DuPont’s calculations of how much was released during the incident. 
c Previously, DuPont had found in a study on a methyl mercaptan storage tank that in the event of a fire, the tank’s relief valves could 
release about 10,000 pounds per hour of methyl mercaptan to the atmosphere, causing off-site concentrations exceeding the ERPG-3 
value. To reduce this release rate, DuPont insulated the methyl mercaptan storage tank to decrease the amount of methyl mercaptan that 
would exit the relief valves during a fire. DuPont aimed to prevent any methyl mercaptan release rate of greater than 4,500 pounds per 
hour “to avoid ERPG-3 concentrations.” During the incident, methyl mercaptan released at a rate of 9,000 pounds per hour—double the 
threshold release rate DuPont specified to avoid ERPG-3 (100 ppm) concentrations. 


FINAL COPY 


Page 55 





U.S. Chemical Safety and 
Hazard Investigation Board 


Toxic Chemical Release at the 
DuPont La Porte Chemical Facility 

La Porte, Texas | Incident Date: November 15, 2014 | No. 2015-01-l-TX 



Intense smell" observed 
at 6:14 am 


'Strong" odor observed at 
6:30 am 


Emergency Response Guidebook 
Protective Action Zone 


DuPont manufacturing 
building methyl 
mercaptan release point 


Figure 17. Overhead Image of DuPont La Porte Facility with Recommended Downwind Protection Zone (Shown in Yellow) Based 
on the 2016 Emergency Response Guidebook [12, p. 297]. Downwind sections of Highway 225 and residential areas were within 
the area recommended for public protection from a methyl mercaptan chemical leak. Source: Google Earth, with annotations by 
CSB. 

Guidance to Industry 

Chemical dispersion modeling can be an effective risk-based emergency response tool, but its results are highly 
dependent on accurate input data. During an emergency, it can be difficult to obtain an accurate release rate, 
limiting the validity of resulting models [8, p. 239]. 

Companies can better protect the public from hazardous chemical exposures by identifying a conservative area 
where people should take protective action (e.g., sheltering-in-place) in the event of a chemical release, and then 
scaling back that area only when reliable information becomes available to justify reducing the protection zone. 
In addition, the data available to emergency responders can be enhanced by fence-line monitoring using fixed or 
portable monitors (Section 4.8.4). Such monitors can provide real-time data on whether the hazardous chemical 
is migrating off-site at dangerous concentrations. 

4.8.2 Physical Properties of Methyl Mercaptan 

The ERT did not alert the local authorities to notify the public of the chemical release because some emergency 
response personnel believed methyl mercaptan was lighter than air and would not affect the local community. A 
La Porte facility employee informed the CSB as follows: 
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The [sheriffs deputy] asked me, how did I know that [methyl mercaptan] was not affecting 
anybody in the La Porte area. I said, ‘Til ask that question while I’ve got [an emergency response 
representative] on the phone.” So, I asked, and that’s when I was told that methyl mercaptan is 
lighter than air and it dilutes out, and that it would have dissipated, pretty much, by the fence 
line. 

Methyl mercaptan, however, is heavier than air a and will tend to stay near ground level. DuPont’s technical 
standard for methyl mercaptan states that methyl mercaptan “gas is colorless and heavier than air, so that it can 
spread at ground level.” Also, DuPont’s safety data sheet (SDS) b for methyl mercaptan specifies its vapor 
density, showing that methyl mercaptan is heavier than air (Figure 18). The CSB could not determine why the 
emergency response representative communicating this information believed that methyl mercaptan was lighter 
than air. 



Figure 18. DuPont's Safety Data Sheet for Methyl Mercaptan. It indicates that methyl mercaptan is heavier 
than air. Source: DuPont. 


County emergency responders also had difficulty understanding the chemical properties of methyl mercaptan 
during the release. A post-incident narrative written by a member of the Harris County Hazardous Materials 
Response Team states: 


a The relative gas density or vapor density of methyl mercaptan is 1.66, meaning it is heavier than air, whose density is 1 [50]. 
b Beginning in 2012, OSHA’s Hazard Communication Standard (HAZCOM) renamed material safety data sheet (MSDS) to safety data 
sheet (SDS) [156, pp. 5, 7]. Although referred to in this report as an SDS, the document shown in Figure 16 uses the older MSDS 
language. 
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Copies of the Safety Data Sheets were retrieved from the [Channel Industries Mutual Aid] 
Command Van. The terms “methyl mesh and methyl mash” were used in multiple conversations 
but there was no data in the SDSs concerning either term. 

“MeSH” is an industry initialism for methyl mercaptan, which DuPont personnel also use, a but personnel did not 
adequately communicate the formal chemical name to external emergency response agencies. b 

Guidance to Industry 

Companies should ensure that all personnel who may assist with technical emergency response functions are 
trained on and understand the information contained in SDSs. Companies should also consider how to 
communicate formal chemical names to outside parties, such as emergency responders, by either ensuring that 
all staff are trained on and familiar with formal chemical names (e.g., methyl mercaptan, rather than MeSH) or 
by ensuring that SDSs include all alternative substance names, such as shorthand names, initialisms, or 
abbreviations [13]. 

4.8.3 Chemical Sensor Data 

During the release, methyl mercaptan detectors inside and outside of the manufacturing building alarmed on the 
control panel. DuPont La Porte had designed the outside detectors to alarm on the control panel when they 
sensed a methyl mercaptan concentration of 25 parts per million (ppm) or greater, 0 specifically to “provide an 
early warning for a significant release of [methyl mercaptan] that could have impact off-site.” The three 


a “MeSH” is shorthand based upon methyl mercaptan’s chemical formula: CH 3 SH. “Me” represents the methyl group (CH 3 ) and “SH” 
represents the mercaptan group (SH)—these initialisms combine to form “MeSH.” 

b The material safety data sheet in Figure 16 does include the term “MeSH” as a synonym for methyl mercaptan. Emergency responders 
had access to this sheet; however, they may have been specifically looking for the term “methyl mesh” as a synonym and may not have 
realized that the listed synonym “MeSH” referred to the same chemical. 

c The ERPG-2 level for methyl mercaptan is 25 ppm. This level “is the maximum airborne concentration below which nearly all 
individuals could be exposed for up to one hour without experiencing or developing irreversible or other serious health effects or 
symptoms which could impair an individual’s ability to take protective action.” Emergency responders use ERPG-1, -2, and -3 
concentration data to determine how to protect the public [167]. 
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detectors inside the manufacturing building a (Figure 3) were also set to alarm on the control panel when they 
detected 25 ppm methyl mercaptan and were intended to protect workers from exposure to methyl mercaptan. b 


From DuPont’s management of change documentation for installation of methyl mercaptan detectors 
inside the manufacturing building: 

“Present Conditions and Description of Proposed Change: Personnel can enter a potentially 
hazardous location without knowing MeSH [methyl mercaptan] has been released to the environment.” 

The ERT, however, did not use the data from these detectors to identify whether there was a potential for an off¬ 
site release. 0 The CSB found that during the incident, the Board Operator communicated information about the 
process to emergency response personnel, possibly including readings from these detectors, but these 
concentration data do not appear to have been considered when determining the potential for dangerous methyl 
mercaptan concentrations off-site. The loss of the Shift Supervisor (Process Coordinator) appears to have 
contributed to DuPont La Porte’s not considering these data when assessing the magnitude of the release during 
the incident. 

4.8.4 Air Monitoring 

DuPont La Porte personnel did not monitor (test) the air for methyl mercaptan along the site’s property line 
(fence line) during the release. DuPont did not have fixed fence-line detectors, necessitating the assignment of 
individuals to perform air monitoring manually. The company never performed this critical monitoring along 
the fence line during the initial release. 

Harris County personnel performed air monitoring near Texas Highway 225 (Figure 16) at approximately 8:07 
am and did not detect methyl mercaptan in the air. d This air monitoring, however, was performed five hours 
after the release began and two hours after the methyl mercaptan pump was turned off (which significantly 
slowed the release). This value, therefore, did not accurately represent the off-site methyl mercaptan 


a There were three methyl mercaptan detectors located inside the manufacturing building, on the first and fourth floors. The third floor, 
where the release occurred, did not have any methyl mercaptan detectors. 

b The 25 ppm alarm set point is 50 times NIOSH’s REL of 0.5 ppm, and more than double OSHA’s ceiling limit of 10 ppm [50]. 
Therefore, alarming at this detection level could not protect workers from exposure to methyl mercaptan. 

c Post-incident, the methyl mercaptan detectors were tested and evaluated to determine whether they worked. Not all of the detectors had 
the correct span of 0 to 50 ppm, and so some of them would not have been able to read up to 50 ppm. Additionally, these detectors are 
limited to detecting a maximum concentration of 50 ppm. 

d During the morning of November 15, 2014, the Harris County Pollution Control Services Department and the Houston Bureau of 
Pollution Control and Prevention investigated odor complaints. There were 10 confirmed odor complaints downwind from the DuPont 
La Porte facility (see Appendix C: Odor Complaints). 
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concentrations during the release. A measurable concentration of methyl mercaptan would have been more 
likely to be detected when the methyl mercaptan pump was operating. 

Guidance to Industry 

Monitoring for hazardous gases along the fence line at chemical facilities can help the company, emergency 
responders, and the public understand the nature and extent of a chemical release. Monitoring for hazardous 
gases at fence lines can be performed by fixed detectors, which can continually collect and record data, 
providing early notification of releases outside the property. 3 When fixed detectors are not available, a person 
using a portable gas detector may also perform air monitoring. This strategy, however, introduces additional 
risk because that individual may enter a hazardous or toxic environment. Proper PPE, including respiratory 
protection, must be worn during manual air monitoring operations. In conditions with an unknown 
concentration and a potential inhalation hazard, the proper respiratory PPE for personnel, under HAZWOPER, 
would be positive pressure air-supplying respirators (i.e., SCBAs) until it is determined to be otherwise. b 

Including air monitoring requirements in company emergency response plans and action checklists can help 
ensure that fence-line air monitoring is performed during emergencies. Personnel responsible for performing air 
monitoring should also be preassigned and quickly able to access air monitoring equipment. 

4,9 Emergency Response Conclusions 

As discussed in this section, there were significant deficiencies in DuPont La Porte’s emergency response to the 
toxic and flammable methyl mercaptan release. Many of the deficiencies stemmed from a flawed emergency 
response system, including flawed implementation of the emergency response plan. Solutions to most of these 
deficiencies are covered in Appendix D: Emergency Response Tables. The CSB encourages companies to 
review their emergency response systems and related plans to ensure they incorporate the lessons learned from 
this investigation. 


a In 2015, the EPA finalized a rule for refineries to monitor benzene at their fence lines [153, p. 3], [154], 40 C.F.R §§ 60, 63 (2015). In 
promulgating this rule, the EPA acknowledges the importance of monitoring potential sources of hazardous materials and their impact on 
the surrounding community [153, pp. 6, 9]. The CSB supported the EPA’s proposal for fence-line monitoring and advocated for an 
automatic, continuous system providing real-time data for several reasons, including strengthening community planning and 
preparedness [141, pp. 1-3]. 

b “Employees engaged in emergency response and exposed to hazardous substances presenting an inhalation hazard or potential 
inhalation hazard shall wear positive pressure self-contained breathing apparatus while engaged in emergency response, until such time 
that the individual in charge of the [incident command system] determines through the use of air monitoring that a decreased level of 
respiratory protection will not result in hazardous exposures to employees” ( 29 C.F.R. § 1910.120 (q)(3)(iv) . 
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5 DuPont's Process Safety Management System 

DuPont, an American Chemistry Council (ACC) member company and Responsible Care practitioner, 
experienced three major process safety incidents that the CSB investigated over the course of five years, despite 
implementing its own corporate process safety management system. These incidents were the 2014 La Porte, 
Texas, methyl mercaptan release; the 2010 Belle, West Virginia, phosgene release [14]; a and the 2010 Buffalo, 
New York, hot work incident [15]. b During the present investigation, the CSB found a large number of 
significant process safety deficiencies at DuPont La Porte that contributed to the incident (see Interim 
Recommendations and Section 6) [1]. 

According to CCPS, process safety management systems 0 are “comprehensive sets of policies, procedures, and 
practices designed to ensure that barriers to episodic incidents are in place, in use, and effective” [16]. A 
process safety management system will have a variety of programs to address process safety. In addition to 
process safety, chemical manufacturing facilities typically also have programs to address personal safety. 
Personal safety d programs and process safety 6 programs are distinct, and both are important. 

DuPont developed its own corporate process safety management system that integrated regulatory requirements 
and voluntary f elements. Companies create their own process safety management systems to address regulatory 
requirements, including those under OSHA’s Process Safety Management (PSM) standard and the EPA’s Risk 
Management Plan (RMP) rule. Based on the chemicals stored on-site, including methyl mercaptan, DuPont La 
Porte determined that PSM and RMP applied to the Lannate® process (Sections 5.1.1 and 5.2.1). These federal 
safety regulations provide a process safety management system framework for companies to use in developing 
their own programs. In addition to meeting these regulatory requirements, DuPont also voluntarily sought to 
integrate the Responsible Care g Management System (RCMS) framework into the company’s own management 
system. 


a The CSB investigated three separate incidents that occurred in a 33-hour period at a DuPont facility in Belle, West Virginia. One 
worker was killed by the release of the highly toxic chemical phosgene [14]. 

b The CSB investigated a hot work incident in Buffalo, New York, that killed one contractor and seriously injured another [15]. 

6 In general, the term process safety management system is interchangeable with process safety management program. 

“Personal safety” incidents affect individual workers, resulting in first aid cases, recordable injuries, lost-time injuries, or fatalities. 
Typical causes of personal safety incidents include slips, trips, falls, lacerations, and dropped objects. Personal safety programs try to 
reduce the number of worker injuries from these types of hazards by managing individual behaviors. Common areas that personal safety 
programs address include personal protective equipment, stop work authority programs, working at heights, hazardous material 
communications, confined space permitting, lockout/tagout, cranes and heavy lifts, area access controls, and vehicle operation. 

6 “Process safety” incidents, on the other hand, include chemical releases, fires, and explosions. Process safety incidents can result in 
large-scale destruction to site and community infrastructure and can lead to multiple injuries and fatalities. Process safety programs try to 
prevent these incidents by identifying and controlling the process hazards. Examples of process safety programs include process hazard 
analysis, inherently safer design, pressure relief systems, automated safety controls, operating procedures, management of change, audits, 
emergency response systems, and community involvement programs. 

f 

ACC’s Responsible Care Management System is one example of a voluntary process safety management system. Another is CCPS’s 
Risk Based Process Safety Management System, whose 20 process safety elements are detailed in Guidelines for Risk Based Process 
Safety [52]. 

g The chemical industry developed Responsible Care to help guide companies toward safe and responsible operation. 
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This section addresses DuPont’s requirements under OSHA, the EPA, and ACC that the DuPont La Porte site 
integrated into its site process safety management system used at the time of the November 15, 2014 incident: 

• OSHA’s Process Safety Management Standard (Section 5.1) 

• EPA’s Risk Management Plan Rule (Section 5.2) 

• ACC’s Responsible Care (Section 5.3) 

Additionally, this section discusses how DuPont integrated and implemented the frameworks provided by PSM, 
RMP, and Responsible Care into its own corporate safety management system. Ultimately, this PSM system 
governed operations at the DuPont La Porte facility at the time of the November 2014 incident (Section 5.4). 
DuPont La Porte’s ineffective implementation of the PSM standard, the RMP rule, Responsible Care, and 
DuPont’s corporate process safety management system resulted in numerous process safety deficiencies that led 
to the incident (Section 6). The incident prompted OSHA and the EPA to investigate the DuPont La Porte site 
and resulted in each of these agencies’ initiating enforcement actions for alleged violations of federal process 
safety regulations (Section 5.1.2 and Section 5.2.2). The November 2014 incident also caused both ACC and 
DuPont to evaluate and make changes to their process safety management systems (Section 5.3.4, Section 
5.4.1.3, and Section 6.1). 

5.1 OSHA 

The Occupational Safety and Health Act of 1970 (OSH Act) was 
enacted “to assure safe and healthful working conditions for working 
men and women; by authorizing enforcement of the standards 
developed under the Act; by assisting and encouraging the States in 
their efforts to assure safe and healthful working conditions; by 
providing for research, information, education, and training in the field of occupational safety and health; and 
for other purposes.” a The Act led to the establishment of OSHA on April 28, 1971 [17, p. 16]. 

OSHA developed the Process Safety Management standard in response to the 1990 Clean Air Act Amendments 
and multiple safety incidents, such as the 1984 Union Carbide toxic release in Bhopal, India, and the 1989 
Phillips Petroleum Company explosions and fires in Pasadena, Texas [18]. 

5.1.1 The Process Safety Management Standard 

The stated purpose of the PSM standard is to prevent or minimize the consequences of catastrophic releases of 
toxic, reactive, flammable, or explosive chemicals that may result in toxicity, fire, or explosion hazards. 13 The 



Occupational Safety 
and Health Administration 


a President Richard M. Nixon signed the Willams-Steiger Occupational Safety and Health Act of 1970 on December 29, 1970 [17, p. 17]. 
The OSH Act of 1970 (Jan. L 2004) . 

b 29 C.F.R. § 1910.119 . 
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standard aims to prevent these releases in locations where employees and others could be exposed to serious 
hazards resulting from chemicals that pose catastrophic risk when stored in quantities greater than stated 
thresholds [19]. 

Through this standard, OSHA strives to bring a systematic approach to addressing the hazards associated with 
these chemicals by establishing a framework for a process safety management system that integrates 
technologies, procedures, and management practices [18]. It does so through the PSM standard’s 14 elements, a 
which formalize bedrock safety principles in the form of regulatory requirements. Some of the requirements 
include performing a process hazard analysis (PHA), managing changes to a process or equipment, establishing 
sound operating procedures, ensuring adequate employee training and involvement, maintaining the mechanical 
integrity of all process equipment, and ensuring a satisfactory level of emergency preparedness in the event of a 
hazardous chemical release. 15 

5.1.2 DuPont La Porte's Implementation of PSM 

One of the avenues for the PSM standard to apply to a process is that a facility must store at least the established 
threshold quantity of what OSHA considers to be a highly hazardous chemical. 0 Based on the amount of methyl 
mercaptan stored at the DuPont La Porte facility, DuPont La Porte determined that PSM regulations applied. d 
Additionally, DuPont La Porte personnel integrated PSM requirements into the site’s process safety 
management system, including performing periodic PSM compliance audits. DuPont La Porte’s first-party PSM 
compliance audits, 6 which were divided over a three-year cycle, took 68 auditor-days to complete between 2012 
and 2014/ These audits, however, did not identify or effectively correct long-standing PSM deficiencies in 
DuPont La Porte’s process safety management system (e.g., deficiencies in performing process hazard analysis 
and management of change) (for more detail, see Section 6: Process Safety Management Deficiencies). In the 10 
years before the November 2014 incident, OSHA conducted one inspection at the DuPont La Porte facility 


a The 14 PSM elements are the following: employee participation, process safety information, process hazard analysis, operating 
procedures, training, contractor management, pre-startup safety review, mechanical integrity, hot work permits, management of change, 
incident investigation, emergency planning and response, compliance, and trade secrets. See 29 C.F.R. $ 1910.119 . 
b 29 C.F.R. § 1910.119 . 

c The PSM standard applies to “(i) A process which involves a chemical at or above the specified threshold quantities listed in appendix 
A to this section; (ii) A process which involves a Category 1 flammable gas (as defined in 1910.1200(c)) or a flammable liquid with a 
flashpoint below 100°F (37.8°C) on-site in one location, in a quantity of 10,000 pounds (4,535.9 kg) or more except for: (A) 

Hydrocarbon fuels used solely for workplace consumption as a fuel (e.g., propane used for comfort heating, gasoline for vehicle 
refueling), if such fuels are not a part of a process containing another highly hazardous chemical covered by this standard; (B) Flammable 
liquids with a flashpoint below 100°F (37.8°C) stored in atmospheric tanks or transferred which are kept below their normal boiling point 
without benefit of chilling or refrigeration.” The PSM standard does not apply to “(i) Retail facilities; (ii) Oil or gas well drilling or 
servicing operations; or (iii) Normally unoccupied remote facilities” ( 29 C.F.R. § 1910.119(a)) . 

d Under the PSM standard, the threshold quantity of methyl mercaptan is 5,000 pounds. 29 C.F.R. § 1910.119 (App. A) . 

6 29 C.F.R. $ 1910.119(0) . 

f 

By dividing the PSM audits into a three-year cycle, the DuPont La Porte site was continually evaluated to see if it met PSM 
requirements. 
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following an oleum a release from the fluoroproducts section of the plant [20] [21]. After the November 2014 
incident, OSHA investigated DuPont La Porte’s Lannate® facility for potential violations, 13 including identified 
PSM deficiencies that contributed to the methyl mercaptan release [22]. c OSHA also performed an expanded 
inspection of the DuPont La Porte site (i.e., evaluated other business units’ compliance) under its National 
Emphasis Program (NEP) for chemical facilities [22]. d 

Although the PSM standard was intended to be performance-based [23], e ’ f in some respects it functions 
primarily as a reactive and activity-based 8 regulatory scheme. While OSHA intends for PSM program elements 
to reduce risk, no explicit requirement appears under the PSM standard to reduce risks or prevent catastrophic 
accidents. Moreover, OSHA is not responsible for proactively evaluating the effectiveness of controls or 
safeguards [24, pp. 31-32]. As discussed in the CSB’s investigation report Drilling Rig Explosion and Fire at 
the Macondo Well , Volume 4, the United States relies on a regulatory framework that can be satisfied by 
“checking the box” when completing a variety of required safety-related activities, such as a PHA or MOC. Yet 
mere compliance with those requirements can still fail to improve safety. The safety-related activity may not 
adequately identify major hazards or control major accident events, in part because the regulatory regime lacks 
targeted risk-reduction, goal-setting requirements [25, p. 26]. h For example, a properly completed MOC can 
effectively reduce the potential for an accident; however, an ineffective one can satisfy regulatory requirements 
and still leave a facility with substantial unmitigated risk. 

Under the OSH Act, it is the employer’s responsibility to “furnish to each of his employees employment and a 
place of employment which are free from recognized hazards that are causing or are likely to cause death or 


a Oleum is a dense, corrosive liquid consisting of concentrated sulfuric acid containing excess sulfur trioxide in solution [133]. 
b Under Section 9 of the OSH Act . OSHA has six months to issue citations after a violation has occurred. 
c In May 2015, OSHA cited DuPont for 11 alleged safety violations stemming from the incident, including deficiencies in PHAs, 
operating procedures, equipment, MOCs, process safety information, training, alarm system, preventing toxic exposure, and contractor 
injury logs [164]. DuPont entered into a formal settlement with OSHA on July 17, 2017 [161]. 

d On July 9, 2015, OSHA cited DuPont for 8 alleged safety violations from an NEP inspection of the adjacent herbicide and 
fluoroproducts (hydrofluoric acid) business units at the DuPont La Porte site, including deficiencies in process safety information, 
process hazard analysis, operating procedures, inspections, and documenting and using recognized and generally accepted good 
engineering practices [155]. After issuing these citations, OSHA placed DuPont in its Severe Violator Enforcement Program [22]. On 
July 17, 2017, DuPont entered into a formal settlement agreement with OSHA [157]. 

e Also referred to as performance-based regulations, such goal-setting regulatory requirements and acceptance criteria are specified, and 
industry must document that its specific solutions meet the requirements, for example in terms of achieving acceptable risk levels. 

f 

Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents. Section III. Summary and 

Explanation of the Final Rule (February 24, 1992). 

§ Activity-based standards and regulations require the mere completion of an activity and do not focus on the effectiveness of major 
accident prevention or risk reduction efforts. 

h The only two PSM elements that include goal-setting attributes are process hazard analysis and mechanical integrity. The PSM 
standard requires a PHA to “be appropriate to the complexity of the process and [to] identify, evaluate, and control the hazards involved 
in the process” ( 29 C.F.R. $1910.1 19(e)(1)) . Additionally, under the heading “Mechanical Integrity,” the PSM standard requires that 
“the employer shall correct deficiencies in equipment that are outside acceptable limits (defined by the process safety information in 
paragraph (d) of this section) before further use or in a safe and timely manner when necessary means are taken to assure safe operation” 
( 29 C.F.R. §1910.119(i)(5) ). None of the other 12 elements include goal-setting requirements. Another example of a goal-setting system 
is ALARP (“As Low as Reasonably Practicable”). 
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serious physical harm to his employees” and to “comply with occupational safety and health standards.” a 
Consequently, it is a company’s responsibility to ensure that its implementation of the PSM standard protects 
workers. OSHA typically investigates whether a company is effectively complying with PSM requirements, 
such as management of change, after an incident occurs. Some companies may be complying with PSM 
elements without actually reducing risks to employees, and that situation may not be recognized until after an 
incident occurs. For PSM elements to be effective in accident prevention, a facility’s implementation must be 
aimed at risk reduction, and company audits must be substantive, helping companies ensure that their PSM 
programs are working. 

5.1.3 Recent Developments Affecting the PSM Standard 

The PSM standard has undergone little reform since its inception in the 1990s. Following the April 2013 
explosion and fire at a fertilizer storage and distribution facility in West, Texas, President Obama issued 
Executive Order 13650, “Improving Chemical Facility Safety and Security.” 13 The executive order tasked a 
working group of federal agencies, including OSHA and the EPA, with modernizing policies, regulations, and 
standards to improve the safety and security of chemical facilities. In addition, the CSB placed “process safety 
management for the 21st century” on its Drivers of Critical Chemical Safety Change list because additional 
work is necessary to modernize federal process safety regulations [26]. 

5.2 Environmental Protection Agency 

In early 1970, the United States began to experience a new and 
elevated sense of public concern about the environment, including 
air, land, and water pollution and protection. President Nixon sent 
to Congress a plan to consolidate many of the federal government’s 
environmental responsibilities under one new agency, the Environmental Protection Agency. Reorganizing 
would permit response to environmental problems in a manner that would exceed the previous capability of 
government pollution control programs. The EPA was established on December 2, 1970 [27]. 

5.2.1 Risk Management Plan Rule 

The EPA’s Risk Management Plan rule constitutes that agency’s efforts aimed at chemical accident prevention 
through the creation of a process safety management system framework, paralleling OSHA’s PSM standard, 
discussed in the previous section. 0 Similar to OSHA’s PSM standard, the RMP rule applies to facilities that the 
Clean Air Act defines as stationary sources of air pollution, and that use or store specific regulated substances 
that the EPA has determined to be extremely hazardous in nature. If any of the specified toxic chemicals or 


£% P*|\JI United States 
M Environmental Protection 

* * !■! Agency 


a 29 U.S.C. § 654 (a) (2010) . 

b Exec. Order No. 13.650. 80 Fed. Reg. 34936 (Aug. L 2013) . 

c 40 C.F.R. § 68 . 
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flammable substances are present at a facility at or above established threshold quantities listed by the EPA in its 
regulation, then the RMP rule applies to the chemical process using that substance at that facility. 

After determining that the RMP rule covers a process, a facility must determine which “prevention program” 
level (Program 1, 2, or 3) applies to the process, based on the process’s potential impact on the public, by using 
off-site consequence analyses, accident history, North American Industrial Classification System (NAICS) code 
classification, and PSM program applicability. Program 3 a processes are subject to additional, more stringent 
requirements than Program l b and Program 2 C processes and must implement elements d of a prevention program 
that are based primarily on OSHA’s PSM standard. In addition, the RMP rule requires all facilities to complete 
a hazard assessment based on analysis of worst-case and alternative (more likely) accident scenarios, and 
identify off-site consequences, compile a 5-year accident history, and coordinate with local emergency 
responders. Program 2 and 3 facilities must develop a management system to implement the RMP elements and 
address emergency response requirements of a responding or nonresponding facility to accidental releases of 
RMP substances. All of these facilities must submit to the EPA a risk management plan, which is a high-level 
summary of a facility’s implementation of and conformance with the RMP rule for all covered processes. 

A facility’s EPA risk management plan summary must include 

• an executive summary; 

• the registration information of the facility; 

• at least one worst-case scenario for regulated toxics and at least one worst-case scenario for flammables; 

• the five-year accident history of covered processes; 

• information concerning emergency response at the facility; 

• at least one alternative release scenario analysis for each regulated toxic substance and at least one 
alternative release scenario to represent all flammable substances; 


a Program 3 is the highest-level management program. Most PSM-covered processes are in Program 3, which requires a rigorous 
management program with detailed record retention criteria and all PSM program elements. Program 3 processes are either subject to 
OSHA’s PSM standard under federal or state OSHA programs or classified in one of 10 specified NAICS codes that require placement in 
Program 3. This designation imposes OSHA’s PSM standard as the prevention program as well as additional hazard assessment, 
management, and emergency response requirements [152], ( 40 C.F.R. § 68.12) . 

b Program 1 is the lowest, simplest management program, covering processes that would not affect the public in a worst-case scenario 
and facilities that have recorded no accidents with specific off-site consequences within the past five years. This designation imposes 
limited hazard assessment requirements and minimal prevention and emergency response requirements [152], ( 40 C.F.R. § 68.12) . 
c Program 2 is an intermediate management-level program and covers processes that cannot be designated as Program 1 but are not 
hazardous enough to be in Program 3. Program 2 imposes streamlined prevention program requirements, as well as additional hazard 
assessment, management, and emergency response requirements [152], ( 40 C.F.R, § 68.12) . 

d Elements of RMP, similar to PSM requirements, include the following: process safety information, process hazard analyses, standard 
operating procedures, training, mechanical integrity, compliance audits, incident investigations, management of change, pre-startup 
reviews, employee participation, hot work permits, and contractors ( 40 C.F.R. §§ 68.65-68.87. Program 3 Prevention Program) . 
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• a summary of the prevention program for each Program 2 process; and 

• a summary of the prevention program for each Program 3 process [28, pp. 1-2]. 

According to the EPA, the risk management plan can provide valuable information by identifying potential 
impacts of a chemical release, steps taken to prevent that release, and emergency procedures should the release 
occur, enhancing local first responders’ ability to prepare for and respond to an accident on a covered RMP 
process by fostering communications about and understanding of the hazards in the event of an emergency 
situation [29]. 

5.2.2 DuPont La Porte's Implementation of RMP 

Based on the amount of methyl mercaptan stored at the DuPont La Porte facility, DuPont La Porte personnel 
determined that the RMP rule applied to the Lannate® process. a Additionally, DuPont La Porte personnel 
decided that Program 3 requirements applied to the Lannate® process and integrated Program 3 requirements 
into its process safety management system. Lor example, DuPont La Porte personnel conducted first-party 
compliance audits on its RMP program. These audits, however, were superficial, focusing on information 
presented in the submitted EPA risk management plan summary and not the substance of the RMP rule 
requirements. Although completing and submitting the risk management plan summary satisfies a part of the 
EPA’s regulatory requirement, the EPA typically does not assess the risk management plan’s effectiveness in 
reducing risk until after an incident. Similar to PSM, a company and its site managers are responsible for 
making their risk management plan effective. 13 

After the incident, the EPA conducted an inspection of the DuPont La Porte facility and alleged 22 separate 
violations of the RMP, including failure to develop and implement written operating procedures, failure to 
adequately implement MOC procedures, failure to implement safe work practices, and mechanical integrity 
violations. This RMP inspection was the first one conducted at the DuPont La Porte facility. Based on these 
allegations, on behalf of the EPA, the U.S. Department of Justice filed a complaint on Monday, July 23, 2018, 
along with a stipulation of settlement with DuPont, in the U.S. District Court for the Southern District of Texas. 
According to the settlement, DuPont was required to pay $3.1 million in civil penalties without admitting 
liability. The EPA did not seek corrective actions because the DuPont La Porte facility is no longer 
manufacturing chemicals [30]. 


a Under RMP, the threshold quantity for methyl mercaptan is 10,000 pounds ( 40 C.F.R. § 68.130, Table 1) . DuPont La Porte identified in 
its RMP a methyl mercaptan scenario that could lead to an off-site impact. 

b Under the General Duty Clause of the Clean Air Act Amendments of 1990 . the owners and operators of facilities that have regulated 
and other extremely hazardous substances are responsible for ensuring that their chemicals are managed safely ( 42 U.S.C. § 7412(r)(lV ). 
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5.2.3 Recent Developments Affecting the RMP Rule 

As noted above, President Obama’s Executive Order 13650, “Improving Chemical Facility Safety and 
Security,” created what the order referred to as the Chemical Facility Safety and Security Working Group. The 
working group took on many tasks a required by the executive order, including reviewing chemical hazards 
covered by RMP and PSM to determine if the RMP or PSM regulatory structures could and should be expanded 
to address additional regulated substances and types of hazards. In addition, the EPA and the Department of 
Eabor were thereafter required to develop a plan, including a timeline and resource requirements, to implement 
and enforce any expansion of RMP and PSM in a manner that would address those additional regulated 
substances and types of hazards. 13 

In response to the executive order, on July 31, 2014, the EPA published a request for information concerning its 
proposed supplementation of its RMP rule [31]. On March 14, 2016, the EPA published its proposed rule, titled 
Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act, Section 
112(r)(7), for notice and comment [32]. On January 13, 2017, the EPA published a final RMP rule amending 40 
C.F.R. § 68 requirements (82 Fed. Reg. 4594). Before the rule took effect, the EPA delayed the implementation 
of the January 13, 2017 amendments until February 19, 2019, to review three petitions it had received requesting 
reconsideration of the final rule. 0 Because PSM and RMP modernization is a priority goal of the CSB (see 
“Drivers of Critical Chemical Safety Change” [33]), the CSB provided written comments to the EPA on these 
occasions. d On September 21, 2018, the U.S. Court of Appeals for the D.C. Circuit issued its mandate, making 
the 2017 RMP Amendments Rule effective [34]. On December 3, 2018, the EPA published a final rule that will 
incorporate the RMP amendments into the Code of Federal Regulations ( 40 C.F.R. § 68 ) [34]. The EPA is also 
working on an RMP Reconsideration Rule, which proposes rescinding certain amendments, including those 
related to safer technology and alternative analyses, third-party audits, incident investigations, and information 
availability [35]. This proposed rule would also modify amendments relating to local emergency coordination, 
emergency exercises, public meetings, and compliance dates [35]. 


a For more information, see the Department of Homeland Security’s “ Actions to Improve Chemical Facility Safety and Security—A 
Shared Commitment .” 

b Exec. Order No, 13,650. 80 Fed. Reg. 34936 (Aug. 1,2013). 

0 On June 14, 2017, the EPA published a final rule to delay the effective date of the RMP rule amendments until February 19, 2019 ( 82 
Fed. Reg. 27133 (June 14, 2017)) . In July 2017, various plaintiffs filed a petition for judicial review of the June 14, 2017 delay rule. On 
August 17, 2018, the U.S. Court of Appeals for the D.C. Circuit vacated the June 14, 2017 EPA regulation that delayed the effective date 
of the final RMP Amendments Rule ( Air Alliance Houston et al. v. EPA et al ., No. 17-1155 (DC Cir. 2018)) . 

d Before the EPA issued its final RMP Amendments Rule on January 13, 2017, the CSB also expressed encouragement to the EPA over 
the needed improvements contained in its new regulations intended to prevent chemical incidents. The CSB viewed this activity to be a 
good initial step, since the rule adopted several new requirements to help advance chemical safety and the prevention of accidental 
releases, including improving communication between facilities and emergency responders, requiring root cause analyses of incidents 
and near misses, and requiring chemical facilities to consider “inherently safer” chemicals and production processes [143]. That is why, 
in July 2018, the CSB wrote with great concern to the EPA in response to that agency’s May 30, 2018, proposed rule , which proposed 
scaling back what had been previously proposed on January 13, 2017 [137]. For more information on the current RMP rule requirements, 
see “ RMP Amendments Compliance Information ” from the EPA. 
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5.3 American Chemistry Council 

The roots of the American Chemistry Council 
(ACC) go back to the late 1800s and the formation 
of the Manufacturing Chemists’ Association. In 
1978, the association changed its name to 
Chemical Manufacturers’ Association. Finally, in 
2000, the association became the ACC [36]. 

The ACC’s mission is “to deliver value to our members through advocacy, using best-in-class member 
engagement, political advocacy, communications, and scientific research” [37]. The ACC is a trade 
organization in the United States that represents chemical companies [37] and requires its member companies to 
adhere to its Responsible Care program, a voluntary program developed by the chemical industry to help guide 
companies toward safe and responsible operation [38]. The design and implementation of this program are 
independent of government involvement and legislative or regulatory requirements.* According to the ACC, 
industry-based trade associations and process safety management systems, however, can only supplement 
government process safety regulations. 13 

Even though DuPont experienced major chemical safety incidents and process safety management deficiencies, 
it still met its Responsible Care requirements. At the time of the November 15, 2014 incident, DuPont’s process 
safety management system conformed to the requirements of the Responsible Care Management System 
(RCMS), a key part of Responsible Care. As part of RCMS, DuPont La Porte’s process safety management 
system was audited for conformance. Neither first-party nor third-party Responsible Care conformance audits 
identified, prevented, or mitigated deficiencies in DuPont La Porte’s implementation of its management system 
(see Section 6). The November 15, 2014 incident at DuPont La Porte played a role in the ACC’s launch of a 
Process Safety Performance Improvement Task Force, discussed later in this section, endorsed to drive 
continuous improvement in process safety and occupational safety. 

This section discusses the history of Responsible Care (Section 5.3.1), the current requirements for Responsible 
Care (Section 5.3.2), the Responsible Care conformance audits at DuPont La Porte (Section 5.3.3), recent 
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a Responsible Care is practiced in 65 economies around the world [89]. In some instances, Responsible Care is a requirement of a local 
trade association, allowing the associations to implement it according to their needs [88, p. 2]. 

b In the ACC’s public comment to the EPA’s RMP revisions (see Section 5.2.1), it suggested that instead of having new requirements for 
Safer Technology and Alternatives Analysis, there should be a working group to evaluate leveraging the use of voluntary programs such 
as Responsible Care to achieve these goals [126, p. 43]. Additionally, the ACC’s Process Safety Code states that the code “is also 
intended to complement regulatory requirements (e.g., OSHA’s PSM standard and EPA’s RMP standard). Regulatory standards, by 
necessity, focus on process safety at an individual facility. In contrast, the Process Safety Code addresses issues at a more universal 
level, such as across a division or corporation, and includes a company commitment to set expectations regarding process safety, define 
accountability for process safety performance, and allocate adequate resources to achieve performance expectations” [44, p. 1]. 
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developments in Responsible Care (Section 5.3.4), and improvement opportunities for Responsible Care 
(Section 5.3.5). 

5.3.1 History of Responsible Care 

Prompted by several serious process safety incidents in the 1980s (notably the 1984 Bhopal disaster), a the 
Canadian Chemical Producers’ Association drafted the original Responsible Care Codes. Member companies 
were required to adhere to these codes to build public trust by showing that they were committed to “doing the 
right thing” by operating safely and responsibly [39]. In 1988, the ACC b —a U.S. trade association that 
currently represents 187 companies 0 —adopted Responsible Care and made it a condition of membership [40]. d 

Since its adoption, ACC’s Responsible Care program has evolved through efforts to meet the needs of industry 
and its members. 6 For example, in 2003, ACC reshaped its Responsible Care obligations from a series of codes 
into a management system called RCMS, f which is intended to provide a framework for integrating Responsible 
Care within a company’s management system. In 2003, ACC also added a third-party audit verification 
requirement to determine whether member companies are meeting their Responsible Care obligations. ACC 
made additional changes to the Responsible Care requirements in 2004, 2005, 2008, 2012, 2013, and 2017. 8 
Furthermore, according to the ACC, “the development of the Process Safety Code demonstrates how 
Responsible Care evolves to maintain and improve effectiveness, as well as responds to industry trends and field 
learnings.” The ability to make such changes to the Responsible Care program quickly gives the ACC the 
flexibility to adapt the program as needed areas of improvement are identified from industry trends and field 
learnings. Regulatory changes, on the other hand, are historically more difficult and time-intensive to 
implement (see Sections 5.1.1 and 5.2.1). 


a On December 3, 1984, a methyl isocyanate release at the Union Carbide insecticide plant in Bhopal, India, resulted in an estimated 
3,800 deaths within days, and tens of thousands of injuries. Over a period of years, the release killed tens of thousands of people [148]. 
b At the time of adoption of Responsible Care, the ACC was known as the Chemical Manufacturers Association. It changed its name to 
American Chemistry Council in June 2000 [119]. 

6 The ACC represents 140 members, 17 affiliates, and 17 associate companies [170]. 

d An international trade association, the International Council of Chemical Associations, manages Responsible Care. The requirements, 
however, vary between member countries [89]. In this section, unless otherwise stated, Responsible Care requisites refer to the ACC’s 
obligations in the United States. 

6 For example, an explosion occurred at the First Chemical plant in Pascagoula, Mississippi, in 2002. The CSB investigated the incident 
and found significant differences between what the company asserted in its Responsible Care self-audit report and the actual facility 
status before the explosion. After the accident, the ACC changed its audit methodology from sole reliance on first-party audits to the use 
of independent third-party audits [146, p. 59], [87, p. 20]. 

f 

The ACC defines a management system as a set of organized policies, procedures, and practices that express a set of commitments 
around a set of core objectives and values. 

g The ACC changed the Technical Specification in 2004, 2005, 2008, and 2013 [41, p. 18]. The Guiding Principles were revised in 2008 
[40]. The third-party audit requirements were changed in 2017 [92]. The Product Safety Code and Process Safety Code were approved 
in 2012 and required beginning in 2013 [40], [41, p. 16]. 
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5.3.2 Responsible Care Requirements 

Today’s Responsible Care program has four main program elements: 

1. Adhering to the Responsible Care Guiding Principles 

2. Implementing the Responsible Care Product Safety Code, Process Safety Code, and Security Code 

3. Measuring and publicly reporting performance 81 

4. Applying the Responsible Care Management System to achieve and verify results [38] 

According to the ACC, the Guiding Principles serve as the ethical foundation of the Responsible Care program 
[41, p. 1]; the Technical Specification of the RCMS and the supplemental codes are the portions of the system 
that have to be audited [42]. DuPont—as a member of the ACC—agreed to implement the latest versions of the 
Guiding Principles, Technical Specification, Security Code, b Product Safety Code, c and Process Safety Code. 

Per the ACC, Responsible Care’s 12 Guiding Principles are its foundation [41, p. 1]. ACC member companies 
endorse and commit to these aspirational objectives, which include the following: 

• To design and operate facilities in a safe, secure, and environmentally sound manner 

• To instill a culture throughout all levels of the organizations to continually identify, reduce, and manage 
process safety risks 

• To make continual progress toward a goal of no accidents, injuries, or harm to human health and the 
environment from products and operations, and openly report health, safety, environmental, and 
security performance [43] 

The ACC built the RCMS from its Responsible Care principles. The ACC asserts that the RCMS “is an 
integrated health, safety, security and environmental management system based on the principles of Responsible 
Care and the Policy-Plan-Do-Check-Act continual improvement cycle” [41, p. 1]. The Responsible Care 
Technical Specification divides the requirements of the RCMS into five categories: policy and leadership; 
planning; implementation, operation, and accountability; performance measurement and corrective and 
preventive action; and management review [41, p. 5]. The requirements stated in the Technical Specification 
overlap with both PSM and RMP. These requirements incorporate developing a management system that 


a The ACC publicly reports specific personal and process safety metrics by company and personal and process safety metrics in 
aggregate [127]. 

b According to the ACC, it adopted the Responsible Care Security Code “to further enhance the security of our facilities, our 
communities, and the essential products we produce” [128]. 

c According to the ACC, it adopted the Responsible Care Product Safety Code “to drive continuous improvement in chemical product 
safety as part of the industry’s signature environmental, health, safety, and security management system” [129]. 
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includes employee participation, process safety information, compliance (conformance audits), incident 
investigation, training, emergency planning and response, MOC, PHA, and contractor management. 

The ACC expanded its third-party audit requirements by adding codes. The organization states that these codes 
aim to supplement the Technical Specification of the RCMS [44, p. 1]. In 2012, the ACC published its 
Responsible Care Process Safety Code of Management Practices [44], requiring member companies to 
implement it by January 1, 2013 [41, p. 16]. The ACC states that the code sets forth its “collective commitment 
to a culture of process safety throughout our chemical processing operations, management systems and 
leadership organizations” [44, p. 1]. Additionally, the code “aims to supplement existing process safety 
requirements contained within the Responsible Care Management System® ... technical specifications, by 
specifically addressing process safety concepts such as leadership, accountability, and culture in order to drive 
overall process safety performance improvement” [44, p. 1]. The Process Safety Code breaks down its 
management practices into seven categories: leadership and culture; accountability; knowledge, expertise, and 
training; understanding and prioritization of process safety risk; comprehensive process safety management 
system; information sharing; and monitoring and improving performance [44, pp. 1-3]. This code strengthens 
and expands obligations stated in the Responsible Care Technical Specification for practitioners to establish a 
comprehensive process safety management system [44, p. 2]. 


From Responsible Care’s Process Safety Code of Management Practices: 

“Companies will design systems to manage and mitigate identified risks with adequate safeguards. 
Management of process safety will take into account passive controls; engineering controls; operational 
controls; inherently safer approaches; inspection, maintenance and mechanical integrity programs; 
management of change procedures; and scenario planning” [44, p. 2]. 
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5.3.3 Responsible Care Conformance Audits 

To verify conformance with the RCMS a and Responsible Care Codes, b ACC member companies must undergo 
an independent third-party audit c performed by a qualified auditor d every three years [41, pp. 4, 16]. This audit 
evaluates the practices * * * * * 6 of the corporation’s headquarters and a sampling of the company’s facilities/ depending 
on the number of facilities a company has [42, pp. 6-8]. For example, large companies, such as DuPont, which 
had more than 40 facilities at the time of the 2014 incident, can retain their certification by auditing only eight of 
their facilities and their headquarters every three years. g The ACC designed the auditing system to allow 
companies to manage their auditing process, including multiple location visits over their audit cycles. 

According to the ACC, companies can consider risk and other factors to determine which facilities to submit for 
third-party audits [42, pp. 7-8]. For example, DuPont’s Responsible Care auditing process began in 2005 and 
the company planned on completing all of its facility audits by 2019. As seen in DuPont’s plan, it could take 
more than 14 years before a facility is audited again under Responsible Care, potentially allowing facilities to 
fall out of certification or to be inconsistent with other company facilities for many years while the company 
remains certified under Responsible Care. Additionally, Responsible Care’s third-party audit requirements are 
divided into three groups, depending on the number of facilities a company has. As shown in Figure 19, the 
more facilities a company has, the smaller the percentage of its facilities that have to be audited during an audit 
cycle to obtain Responsible Care certification [42, p. 7]. 


a RCMS is contained in the Technical Specification of the code. This specification is the only portion of RCMS that is required to be 

audited. Responsible Care has undergone multiple changes including a shift to third-party audits and the addition of a Process Safety 

Code. The CSB recommended to the ACC in its investigation into an explosion at First Chemical that the ACC “ensure that ACC 
members understand the audit requirements of Responsible Care and accurately identify and address gaps in facility process safety 
programs” [146, p. 67]. Beginning in 2004, the ACC shifted from first-party to independent third-party audits for certification of a 
company’s RCMS program. It also required companies to report their statistics on the Responsible Care website. In 2012, Responsible 
Care added the Process Safety Code to supplement the Technical Specification, making it auditable as well [40]. 
b In November 2017, the ACC changed its third-party audit requirements [92, pp. 3-4]. 

6 DuPont used both third-party audits and self-audits (first-party) to demonstrate conformance with Responsible Care. Self-audits are 
conducted by auditors from the facility being audited, and third-party audits are conducted by auditors from an independent organization 
[66, pp. 27-28]. 

d Third-party audits are not done by ACC; they are performed by independent auditing firms accredited by the ANSI-ASQ National 
Accreditation Board (ANAB). 

6 The portions of Responsible Care that are audited are the Technical Specification and supplemental codes (Process Safety, Security, and 
Product) [45, p. 10]. 

f 

According to the ACC, for purposes of auditing, a facility is defined as a “location falling under an ACC member’s/Responsible Care 
Partner’s dues calculations at which commercial chemicals are manufactured, handled, transported, [and] stored and where employees or 
others working on behalf of the ACC member/Responsible Care Partner are present” [42, p. 2]. 

§ The ACC requires that two-thirds of the facilities currently being audited be among those not audited in the previous audit cycle [42, p. 
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Per designated ACC Audit 

Company Size 

Requirements 

Cycle 


33% of facilities(up to a maximum of 

Complete all required 

1-25 facilities 

4) + HQ 

audits. 



Complete all required 

26-40 facilities 

6 facilities+ HQ 

audits 



Complete all required 

41+ facilities 

8 facilities+ HQ 

audits 


Figure 19. Excerpt from Responsible Care's Third-party Audit Requirements. It shows the more facilities a 
company has, the lesser are the audit requirements [42, p. 7]. Source: ACC. 

The ACC acknowledged that the DuPont La Porte site met its Responsible Care requirements 3 in 2007, 
following a third-party audit conducted at the DuPont La Porte facility that certified the facility to be in 
conformance with the RCMS Technical Specification requirements. 15 This was the only third-party Responsible 
Care evaluation ever performed at the DuPont La Porte facility. A third-party evaluator determines only if a 
facility is meeting the Responsible Care requirements that exist at the time of the third-party audit. Furthermore, 
a third-party certification does not imply that a facility is meeting its RCMS requirements years later without an 
additional evaluation of the facility. Additionally, DuPont La Porte personnel performed six self-audits between 
2007 and the date of the incident. 0 None of these audits, however, identified or effectively corrected the many 
serious and long-standing process safety deficiencies at the site. These process safety deficiencies were 
discussed in the CSB Interim Recommendations for this incident and are also described in this report in Section 
6 [!]• 


a At the time of the 2007 audit, the Product Safety and Process Safety codes were not in place and the Guiding Principles were located in 
the Technical Specification. 

b According to the ACC, conformance means meeting code implementation and reporting deadlines; completion of required RCMS third- 
party certification in three-year cycles; and annual reporting of performance results, including process safety incident data. 
c The DuPont La Porte facility did include in its first-party audit the new requirements for Responsible Care. 
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Although Responsible Care requires robust process safety programs at its member facilities, the CSB found that 
the RCMS on its own is not sufficient to ensure that a particular facility’s safety programs are effective. a For 
example, the quality of an audit or assessment can be affected by the amount of information it evaluates. An 
average Responsible Care third-party audit that evaluates a facility’s management system lasts three to five days 
[45, p. 6], b a relatively short amount of time to analyze significant and complex matters, which could potentially 
limit the scope and depth of any audit. 

The ACC’s expectation is that a company’s internal audit process be more detailed than the Responsible Care 
external audit. For example, a DuPont La Porte environmental, health, and safety manager stated that the 
facility’s Responsible Care audits were not as detailed as the audits the company performed to verify 
compliance under OSHA’s PSM standard. 0 DuPont La Porte’s 2007 third-party audit, which covered about 800 
employees and contractors and three business units, took 12 auditor-days. d On the other hand, DuPont La 
Porte’s first-party PSM compliance audits, * * * * * 6 * which were divided over a three-year cycle, took 68 auditor-days to 
complete between 2012 and 2014/ Despite taking more than five times the auditor-days of the Responsible 
Care audit, the PSM compliance audit requirements were not sufficient 8 to identify and resolve process safety 
management deficiencies that contributed to the November 2014 incident (see Section 6). The ACC believes 
that Responsible Care audits verify that a robust, effective management system is in place [46]. The ACC 
further believes its auditable Process Safety Code “differs from regulatory standards that, by necessity, focus on 
process safety at an individual facility. The Process Safety Code is more universal—it addresses issues across a 
division or corporation, and includes a company commitment to set process safety expectations, define 
accountability for process safety performance and allocate adequate resources to achieve performance 
expectations” [47]. Understanding the health of an organization’s process safety management system, however, 
requires a comprehensive assessment of the content and implementation of its programs. 


a The ACC has stated to the CSB, “RCMS is not intended to be a company’s sole safety program. RCMS is one component of the 
Responsible Care program.... Responsible Care is intended to complement regulatory requirements, a company’s safety processes, and 

other initiatives—not replace them.” Moreover, the 2004 RCMS Technical Specification states, “the RCMS is also designed to 

incorporate individual company processes for maintaining regulatory compliance and implementing other company programs and 

commitments such as sustainable development initiatives.” 

b According to a 2015 ACC document, the usual cost for a third-party conformance audit ranges from $6,000 to $10,000. The audit 
typically costs $2,000 per audit day (travel plus auditor time). The CSB calculated the three to five days for audits based on these 
numbers [45, p. 6]. See American Chemistry Council and National Association of Chemical Distributors. A Comparison of ACC 
Responsible Care® and NACD Responsible Distribution® Initiatives . 

6 OSHA requires PSM audits to be performed at least every three years at all facilities covered by the standard ( 29 C.F.R. § 1910.119(oV) . 
d Two auditors worked six days to complete the audit. 

6 29 C.F.R. $ 1910.119(o) . 

f 

Through the division of the PSM audits into a three-year cycle, the DuPont La Porte site was continually evaluated to see if it met PSM 
requirements. 

8 In past investigations, the CSB has identified areas of PSM that could be improved upon. “Modernization of U.S. Process Safety 
Management Systems,” previously on the CSB’s Drivers of Critical Chemical Safety Change List , was renamed in 2018 to “Process 
Safety Management for the 21st century” and remains on the list [26]. 
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Although the ACC can remove membership from companies not satisfactorily conforming to the Responsible 
Care program, a one of the program’s objectives “is to keep as many companies actively implementing the 
program and striving to continuously improve their performance as possible” [48, p. 1]. This objective is 
contained in its Guiding Principles: 

To make continual progress toward a goal of no accidents, injuries or harm to human health and 
the environment from products and operations and openly report health, safety, environmental 
and security performance [43]. 

DuPont was meeting its Responsible Care requirements, as demonstrated by its audits, even though it 
continued to have major process safety incidents across the company. 13 The ACC informed the CSB that 
the November 2014 incident at the DuPont La Porte facility, however, “played a role in the launch of an 
ACC Process Safety Performance Improvement Task Force.” 

5.3.4 Recent Developments in Responsible Care 

As noted in the previous section, the November 15, 2014 incident played a role in launching the ACC Process 
Safety Performance Improvement Task Force. The ACC Board’s Responsible Care Committee 0 proposed the 
task force, and it was endorsed by the ACC in November 2015 to drive continuous improvement by industry in 
process safety and occupational safety. In June 2016, the ACC Board approved the task force’s 
recommendations, including the following: 

• Establishment of new incident information and practice sharing forums 

• Formation of regional support networks 

• Enhanced collaboration with professional societies 

• Enriched data analytics and modified responsible metrics reporting 

• Continuous improvement 

Since the adoption of these recommendations, the ACC has begun implementing several of them. According to 
the ACC, starting in 2016, its Process Safety Committee has held annual process safety forums for ACC 
members to “share process safety information, lessons learned, and exemplary practices.” Additionally, the 
ACC developed a regional network model for sharing noncompetitive process safety knowledge and solutions 


a In the last 10 years, the ACC has removed six companies from its membership due to their failure to meet their Responsible Care 
requirements, and in other instances, companies opted to resign voluntarily from Responsible Care prior to potential removal. 
b The three major investigations were CSB DuPont La Porte Interim Recommendations [1]; E.I. DuPont de Nemours & Co., Inc., Belle, 
West Virginia: Methyl Chloride Release, Oleum Release, Phosgene Release [121]; E.I. DuPont de Nemours & Co Inc. Buffalo , New York 
Flammable Vapor Explosion [122]. 

c The Board Responsible Care Committee is composed of ACC member CEOs or presidents [45, p. 22]. 
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between site process safety practitioners. Specifically, the ACC established regional networks in Houston and 
Philadelphia and is developing three additional networks. Another development within the Responsible Care 
program is the ACC’s adoption of American Petroleum Institute (API) Recommended Practice 754—Process 
Safety Indicators for the Refining and Petrochemical Industries [49]. a The ACC assessed some of its 2017 data 
and publicly reported its high-level findings in 2018. b 

5.3.5 Responsible Care Improvement Opportunities 

In light of the multiple DuPont incidents, the CSB encourages the ACC to evaluate Responsible Care and the 
RCMS for additional improvement opportunities, with the goals of helping member companies identify and 
correct process safety deficiencies, and preventing major chemical incidents at member company facilities. 0 

An example of an opportunity for Responsible Care to strengthen its verification systems is including the 
aspirational Guiding Principles in its third-party verification audits. For example, a Responsible Care auditor 
could delve deeper than the management system and evaluate buildings that contain process equipment, given 
that one of the Responsible Care Guiding Principles is “to design and operate facilities in a safe, secure, and 
environmentally sound manner” [43]. d As demonstrated by the facts of this incident, the Lannate® 
manufacturing building had design deficiencies. The portion of the manufacturing building where the incident 
took place did not have a stated design purpose—the building was not designed for the process, and the process 


a API 754 covers leading and lagging process safety indicators. According to API 754, “The purpose of process safety indicators is to 
identify events or conditions that could ultimately lead to higher-level consequences. Indicators provide a means to measure activity, 
status, or performance against requirements and goals. Monitoring and analyzing performance enables Companies to take corrective 
action as needed. Properly defined and understood indicators can give Companies confidence that the right things are being managed and 
tracked” [49, p. 23]. API further explains, “Leading indicators tend to be forward-looking and indicate the performance of the key work 
processes, operating discipline, or protective barriers that prevent incidents. They are designed to give an indication of potential 
problems or deterioration in key safety systems early enough that corrective actions may be taken” [49, p. 24]. Conversely, API 754 
elaborates, “Lagging indicators tend to be outcome-oriented and retrospective; they describe events that have already occurred and may 
indicate potential recurring problems [that] may include fires, releases, and explosions” [49, p. 23]. In reliance on the now-familiar four- 
tier pyramid diagram first introduced by H. W. Heinrich in 1931 as a representation of his study of accident data gleaned from the 
insurance industry, API 754 breaks down indicators across four tiers. From top to bottom, indicators progress from lagging (Tier 1) to 
leading (Tier 4) [49, pp. 11-12]. The ACC has adopted API 754 to the Tier 2 level—a loss of primary containment but of lesser 
consequence than a Tier 1 incident (e.g., no casualties, property damage less than $2,000, on a release of less than a predefined reportable 
quantity of a process chemical) [145, p. 153]. The ACC has required mandatory reporting under API 754 beginning in calendar year 2018 
for 2017. 

The CSB has discussed API 754 in its Macondo (Volume 3) and Williams investigations. Additionally, as part of the Macondo 
investigation, the CSB held a public hearing on process safety indicators. The CSB has also looked toward CCPS on approaches to 
leading and lagging indicators in its Guidelines for Process Safety Metrics . 

b The ACC reported Tier 1 findings and is still in the process of reviewing Tier 2 events [104]. For more information, see Responsible 
Care Process Safety . 

c As a result of its First Chemical investigation, the CSB previously made a recommendation to the ACC to evaluate its audit program: 
“Ensure that ACC members understand the audit requirements of Responsible Care and accurately identify and address gaps in facility 
process safety programs” (2003-01-I-MS-R11), [146, p. 67]. 

d At the time of the 2007 third-party RCMS conformance audit, the Responsible Care Guiding Principles were different and were 
included in the RCMS Technical Specification. The principle at the time of the audit that most closely relates is “To operate our facilities 
in a manner that protects the environment and the health and safety of our employees and the public.” 
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equipment did not need to be inside a fully enclosed manufacturing building. a Yet even without a process 
requirement to do so, DuPont accepted significant process risk by housing process equipment inside the 
enclosed building, making personnel vulnerable to highly toxic chemical exposure and asphyxiation hazards that 
DuPont had not effectively identified or controlled. 

The manufacturing building was not designed to limit the impact of a toxic chemical leak by containing the leak 
and routing it to a destruction device, such as an incinerator or scrubber. The manufacturing building trapped 
vapors from highly toxic chemical leaks and concentrated them inside the building, increasing risk to workers 
[1, p. 3]. Furthermore, this design did not eliminate the hazards associated with a release to the community or 
environment, which an effectively designed containment building b could have done. Since the manufacturing 
building’s ventilation fans (if functional) routed any toxic chemicals within the manufacturing building to the 
roof, discharging them directly to the atmosphere without an additional destruction device, they did not decrease 
the potential for a hazardous off-site release [1, p. 33]. In this case, a robust assessment of the process’s location 
inside the manufacturing building could have identified the hazards presented. To achieve the ACC’s 
aspirational objectives, such as “designing] and operating] facilities in a safe, secure and environmentally 
sound manner” [43], Responsible Care auditors should look for deficiencies inconsistent with Responsible 
Care’s Guiding Principles. 

When the ACC developed the original RCMS Technical Specification in 2003, it fully incorporated the entire 
aspirational Guiding Principles into the specification. The ACC informed the CSB that adding the Guiding 
Principles as an element into its RCMS Technical Specification proved challenging for auditors and those 
audited, since the Guiding Principles overlapped with requirements found in other sections of the Technical 
Specification or within a company’s existing procedures, creating confusion as to whether separate, additional 
actions were necessary to show conformance with this element. In 2008, the ACC replaced the listing of the 
Guiding Principles within the RCMS Technical Specification with what it believed was a streamlined set of 
auditable requirements intended to reflect the key objectives of the Guiding Principles. The ACC stated that 
based on its experience, it believes the change it adopted in 2008 is the most effective way to address the key 
objectives of the Responsible Care Guiding Principles. 

Another opportunity for Responsible Care to improve its verification program is to evaluate whether the 
company’s process safety management system is functioning as the company intends. For example, 

Responsible Care requires companies to establish and maintain systems to “protect the environment, conserve 
resources, protect worker health and create a safe and secure work environment” and to “establish and maintain 
procedures to respond to accidents and emergency situations, and for preventing and/or mitigating the impacts 


a The packaging area of the building on the ground floor (west side) may have had a legitimate need to be inside a building. Dust control 
and keeping the packaging equipment and methomyl product dry appeared to be important considerations that may have justified keeping 
packaging area equipment housed inside a building [1, p. 32]. 

b A containment building is an enclosure around process equipment to contain potential releases to the environment. Companies 
typically use containment buildings to reduce off-site risk. DuPont La Porte has stated that the manufacturing building was not a 
containment building [1, p. 3]. According to CCPS, “a containment building provides protection outside the building, but can also trap 
and concentrate material from small leaks inside the building, increasing the risk to personnel. Provisions must be made to ensure worker 
protection for a process located in a containment building, such as monitoring the atmosphere in the containment structures, restricting 
access, and requiring proper personal protective equipment when entry into the containment structure becomes necessary” [109, p. 59]. 
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that may be associated with them” [41, pp. 8-9]. The CSB identified that the DuPont La Porte Responsible Care 
audits, however, did not evaluate whether the safety programs implemented to protect employees from 
potentially hazardous environments, such as the toxic methyl mercaptan detectors inside the manufacturing 
building, met the facility’s stated design purpose. 

For example, the 2007 La Porte Responsible Care third-party audit identified the existence of the methyl 
mercaptan detection system but did not evaluate whether this system could effectively protect workers by 
warning them of potentially toxic environments. It found the detection system to be in conformance simply 
because it existed. The CSB, on the other hand, found by evaluating DuPont La Porte’s MOC documentation 
and relevant chemical safety information that the alarm limits did not meet the intent of protecting personnel. 
Specifically, the methyl mercaptan detectors inside the manufacturing building were set to alarm at 25 parts per 
million—a value 50 times greater than the NIOSH recommended exposure ceiling limit and more than double 
OSHA’s ceiling limit [50], [51]. During the November 2014 incident, these methyl mercaptan detectors were 
alarming; however, the system did not signify an early release of methyl mercaptan (see Section 4.8.3), and the 
detectors did not warn workers that they were potentially in a life-threatening toxic environment, because the 
alarms were set above OSHA’s ceiling limit and they were not communicated to personnel. Additionally, 
Responsible Care audits did not identify the gaps in DuPont’s corporate standard for the Management of Highly 
Toxic Materials that allowed toxic gas detection systems to be set above OSHA exposure limits. 

Although the ACC does not make prescriptive requirements for its member companies, it should ensure that 
safety systems, such as toxic gas detection systems, will protect workers from unsafe conditions by functioning 
as the company intended. An effective Responsible Care audit can identify these discrepancies and an auditor 
can issue nonconformances or recommendations (opportunities for improvement) at the end of the audit. 

The ACC has multiple opportunities to improve Responsible Care, including assessing Responsible Care’s 
Guiding Principles in conformance audits, ensuring that safety systems effectively control hazards presented, 
and seeking to add value to the safe operation of member companies where possibilities present themselves. 
Because Responsible Care is a voluntary program applied by 187 companies in the United States and can readily 
adapt to change, it has the potential to be a powerful process safety program.* 1 To fulfill Responsible Care’s 
original mission to build public trust by showing that chemical companies are committed to “doing the right 
thing” by operating safely and responsibly, and its Guiding Principles “to seek continual improvement in the 
integrated Responsible Care Management System to address environmental, health, safety and security 
performance,” the ACC should continue to seek opportunities to strengthen its Responsible Care program [15], 
[43]. 

Guidance to Industry 

Although this section focused on Responsible Care, these learnings can apply to any safety management system. 
Companies can use a variety of programs to manage and evaluate their process safety management systems. 


a The ACC’s Responsible Care program covers multiple aspects of safety, including process safety, security, product safety, 
environmental protection, and occupational safety. 


FINAL COPY 


Page 79 





U.S. Chemical Safety and 
Hazard Investigation Board 


Toxic Chemical Release at the 
DuPont La Porte Chemical Facility 

La Porte, Texas | Incident Date: November 15, 2014 | No. 2015-01-l-TX 


Without an adequate focus on the effectiveness of a process safety management system and its corresponding 
safety program elements, such as the 20 elements of Risk Based Process Safety [52], implementing the system 
will likely not be sufficient to prevent major chemical incidents. Chemical companies should conduct 
comprehensive assessments of their process safety management systems and the accompanying implementation 
of those systems and safety program elements to understand the overall health of their organizations, including 
the effectiveness of accident prevention efforts and the resiliency of operations. 

Companies should assess the implementation of these systems and their associated safety program elements 
associated with them. Some ways in which a company can ensure effectiveness include these: 

1. Ensuring that all company sites adhere to core process safety management system elements and stay 
current with all updates and changes to that system. Because companies can adapt to process safety 
learnings quickly, their process safety management systems should ensure that sites are evaluated to 
ensure consistency with evolving practices to maximize the effectiveness of these safety improvements. 

2. Investing sufficient time and resources to conduct robust audits. This investment should help ensure 
that audits are not rushed and help companies meet the goal of preventing major chemical accidents. 


5.4 DuPoNf s Development and Implementation 
of Its Process Safety Management System 

DuPont has long been perceived as a safety leader a and has asserted 
that its history of process safety extends over two centuries, from its 
gunpowder manufacturing through its present-day production of 
chemicals [53, p. 114]. Over the course of this time, DuPont’s process safety management system evolved with 
the emergence of federal regulations, such as the PSM standard and the RMP rule, as well as the decision to 
engage in Responsible Care. 

DuPont developed several methods that it uses to manage and integrate its process safety systems, including its 
proprietary Safety Perception Surveys and Process Safety Management and Risk Model. b Its corporate process 
safety management system and implementation process involves four steps: (1) building a safety culture, (2) 
management leadership and commitment, (3) implementing a comprehensive process safety management 



The miracles of science 


a As recently as 2013, the DuPont Corporation received the Robert W. Campbell Award from the National Safety Council. According to 
the National Safety Council, “w inn ers represent organizations that have taken great strides in [environmental health and safety] 
excellence. Award winners are acknowledged not only as leaders in the business realm, but also as those that recognize the value of 
protecting employees and their environment” [115]. 

b According to DuPont, there was a demand from other companies for DuPont to share its learnings and safety practices. In 1968, it 
established DuPont Sustainable Solutions , the branch of DuPont (now DowDuPont) that sells the company’s safety systems [113], [114]. 
DowDuPont’s Specialty Products division announced it will divest its DuPont Sustainable Solutions to create a new, independent global 
operations management consulting firm. The transaction is expected to close in July 2019 pending the completion of all closing 
conditions [135]. 
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program, and (4) operational discipline [54, p. 2]. According to DuPont, the effective implementation of these 
steps will result in a robust process safety management system [55, p. 10]. Consequently, DuPont La Porte used 
both the Safety Perception Surveys and the Process Safety Management and Risk Model in implementing its 
process safety management system. 

Despite having robust written process safety management programs (i.e., MOC and PHA), over the course of 
five years, DuPont had major process safety incidents—including those at its Belle, West Virginia; Buffalo, 

New York; and La Porte, Texas sites, each of which resulted in fatalities. The CSB found that DuPont La 
Porte’s ineffective implementation of its integrated process safety management system contributed to the 
severity of the highly toxic material release in the manufacturing building at La Porte. 


According to DuPont Sustainable Solutions’ “Quick 4-Step Review of Process Safety Management,” 

“A strong safety culture, based on a commitment to core values on safety, health, and environmental 
issues, and as evidenced by organizational policies, goals, metrics, and day-to-day decision-making, 
supports establishing safety systems where safety priorities are recognized, not as conflicting with 
other priorities, but rather as inherently necessary for completing any task the right way” [54]. 


DuPont’s corporate process safety management standard lists four key steps for the implementation and 
sustainability of an effective process safety management program: 

1. Establishing an effective and sustainable unified safety culture (addressed in Section 5.4.1 below) 

2. Providing management leadership and commitment (Section 5.4.2) 

3. Implementing a comprehensive process safety management program, including organizational learning 
and continuous improvement to integrate new risk management knowledge, learnings, and practices into 
existing site and corporate systems (Section 5.4.2) 

4. Achieving operational excellence through operational discipline (Section 5.4.2) 

This section breaks down these steps into two parts: (1) Building a Safety Culture (step one); and (2) Using the 
Process Safety Management and Risk Model (steps two through four). 
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5.4.1 Building a Safety Culture 

DuPont’s corporate process safety management standard states that process safety culture a “determines the 
manner by which PSM is implemented and managed at each site as part of both individual and group values and 
behaviors to enable sound decision making and continuous improvement.” Therefore, DuPont links the 
effectiveness of process safety management implementation to the process safety culture of a facility. 

Moreover, previous CSB investigations also support DuPont’s corporate standard that links effective process 
safety management systems with a strong process safety culture. 15 

According to DuPont, establishing a safety culture is the first step in developing a process safety management 
system because a system will be only as effective as its safety culture permits. Additionally, DuPont’s corporate 
process safety management standard recommends periodic site evaluations of process safety cultured DuPont’s 
standard further recommends that sites use the results of process safety culture assessments to highlight 
strengths and develop potential improvement strategies. 


In Essential Practices for Creating, Strengthening, and Sustaining Process Safety Culture, CCPS 
states, 

“A strong, positive process safety culture enables the facility’s [process safety management system] to 
perform at its best. This gives the facility its best chance to prevent catastrophic fires, explosions, toxic 
releases, and major environmental damage” [56, p. 2]. 


For more than a decade, DuPont developed and honed a safety culture program to reduce its OSHA total 
recordable injury rate by assessing and improving occupational (personal) safety, using its Bradley Curve and 
Safety Perception Survey tools (Appendix E). These tools, however, focus on only one aspect of safety 
culture—personal safety. 

DuPont La Porte used the Safety Perception Survey without doing a process safety culture assessment as 
recommended in the corporate process safety management standard. Because this survey did not formally 
assess process safety culture perceptions, DuPont La Porte never evaluated its process safety culture. Had its 


a Examples of a process safety culture from DuPont’s corporate standard include maintaining a sense of vulnerability in terms of process 
safety management risks to prevent complacency or overconfidence, and transparent, timely, and thorough responses to PSM concerns, 
action items, and issues, including leadership measures to prevent a “check-the-box” mentality (i.e., simply accomplishing a task as the 
objective rather than ensuring a high degree of focus on risk management and prevention). 

b Among other investigations, the CSB investigation of the Williams Geismar Olefins Plant Reboiler Rupture and Fire demonstrates the 
CSB’s position that to prevent process incidents, organizations must develop a culture that promotes effective process safety management 
systems [71, p. 52]. 

c DuPont’s corporate process safety management standard does not specifically address how its sites should perform process safety 
culture assessments. DuPont’s standard directs sites to include interactions and discussions with employees, review results of audits, and 
observe physical conditions of the site in performing process safety culture assessments. 
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efforts included a focus on perceptions of process safety as well as personal safety in its Safety Perception 
Survey, or had it performed a separate process safety culture assessment with the intent of improving process 
safety culture as recognized in DuPont’s corporate process safety management standard, DuPont La Porte likely 
would have been more aware of potential process safety issues and better positioned to prevent or mitigate 
future process safety incidents. CCPS recognizes the importance of a strong process safety culture in preventing 
major accidents [56, p. 2]. 

This section discusses the following: 


• The investigations into the catastrophic 2005 BP Texas City explosion that emphasized the way in 
which culture is shaped by the level of focus an organization places on process safety (Section 5.4.1.1) 

• The lack of formal process safety culture assessments at DuPont La Porte (Section 5.4.1.2) 

• Post-incident initiation of formal process safety culture assessments at DuPont legacy sites to address 
gaps in process safety culture perceptions in 2017 (Section 5.4.1.3) 
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5.4.1.1 BP Texas City Incident 


The CSB investigated a 2005 
incident at a BP refinery in Texas 
City, Texas, a and due to concerns 
about the effectiveness of the safety 
management systems at this refinery 
and BP’s other North American 
refineries, as well as concerns about 
BP’s corporate safety culture, the 
CSB issued an urgent safety 
recommendation to the BP Global 
Executive Board of Directors to 
commission an independent panel to 
conduct a thorough review of BP’s 
corporate organizational culture, 
safety management systems, and 
corporate safety oversight at its U.S. 
refineries [57, pp. 3-4]. As a result, 
BP formed the BP U.S. Refineries 
Independent Safety Review Panel, 
commonly referred to as the Baker 



"BP has emphasized personal safety in recent 
years and has achieved significant 
improvement in personal safety performance, 
but BP did not emphasize process safety. BP 
mistakenly interpreted improving personal 
injury rates as an indication of acceptable 
process safety performance at its U.S. 
refineries. BP’s reliance on this data, 
combined with an inadequate process safety 
understanding, created a false sense of 
confidence that BP was properly addressing 
process safety risks.” 


Figure 20. Excerpt from the Baker Panel Report. The Baker Panel found that BP 
emphasized personal (worker) safety performance and did not adequately focus on 
process safety. Similarly, 12 years after this accident, DuPont La Porte's safety culture 
assessments at its site focused solely on personal safety performance. Source: Baker 
Panel Report [58]. 


Panel, b which conducted an independent organizational assessment of BP’s culture and its corporate-level 


oversight of safety management systems at its U.S. refineries [58, pp. viii-ix]. The Baker Panel developed a 
process safety culture survey and supervised its administration among BP’s U.S. refinery workforce, including 
employees and contractors [58, p. 7]. The survey contained 65 items related to the process safety culture at 
participants’ workplaces. 


The Baker Panel concluded that BP “mistakenly interpreted improving personal [worker] injury rates as an 
indication of acceptable process safety performance” (Figure 20) [58, p. xii]. The panel also noted, “the 
presence of an effective personal safety management system does not ensure the presence of an effective process 
safety management system ... [and] BP’s [worker] injury rates were not predictive of process safety 
performance at BP’s five U.S. refineries” [58, p. 21]. 


a On March 23, 2005, a series of explosions occurred at the BP Texas City, Texas, refinery during the restarting of a hydrocarbon 
isomerization unit—killing 15 workers and injuring 180 others. The explosions occurred when a distillation tower flooded with 
hydrocarbons and was overpressurized, causing a geyser-like release from the vent stack [140]. For more information, see the CSB’s BP 
America Refinery Explosion investigation. 

b Former Secretary of State James Baker III chaired the BP U.S. Refineries Independent Safety Review Panel (the Baker Panel) [58, p. 
viii]. 
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After the 2005 BP accident and the published findings of both the Baker Panel and the CSB, much of the 
chemical process industry began to emphasize the importance of understanding and assessing process safety 
cultured A major process safety incident, such as the one at DuPont La Porte, can reveal weaknesses in the 
management of process safety. b 

5.4.1.2 DuPont La Porte Did Not Formally Assess Process Safety Culture 

DuPont La Porte did not use any type of robust, formal process safety culture assessment. Process safety culture 
can affect whether a site has a sense of vulnerability in terms of process safety management risks; complacency 
or overconfidence; and transparent, timely, and thorough responses to PSM concerns, action items, and issues, 
including leadership measures to prevent a “check-the-box” mentality (i.e., simply accomplishing a task as the 
objective rather than ensuring a high degree of focus on risk management and prevention). The Safety 
Perception Surveys conducted at the DuPont La Porte facility before the November 2014 incident were designed 
to lower OSHA total recordable injury rates [59, p. 8]. DuPont did not intend for these surveys to measure or 
address the perception of process safety performance. 

As part of DuPont La Porte’s 2012 Safety Perception Survey, comments were collected and organized by job 
position. Some of these comments, from different levels of the organization, raised safety culture concerns. For 
example, one hourly worker (operator) stated, 

Some fi[rs]t line [supervisors] 0 turn the other way if a worker put[s] production over safety. d 

A professional employee expressed concerns about PSM initiatives at the site: 

Some days it seems like the focus is more about creating documentation and reviewing that 
documentation than on targeting those areas that will have the biggest impact on improved PSM 
performance. From my perspective, I feel like “real” process safety management has suffered in 
some respects and that our processes may actually be less safe than they were before the 
initiatives. 

Safety concerns were expressed by multiple supervisors in the survey comments: 

I hate to say it but not all employees put the same value on safety. That includes [wage roll] 
employees and first line supervisors. DuPont employee actions demonstrate to me that safety 
rules are suggestions and do not have to be followed. 


a In March 2007—two years after the BP Texas City explosion—CCPS published its book Guidelines for Risk Based Process Safety , 
which featured “p rocess safety culture” as an element in its new Risk Based Process Safety model [91]. 

b Other CSB investigations that found a weak process safety culture contributing to an incident include Williams Geismar Olefins Plant 
Reboiler Rupture and Fire [71, p. 52], CSB Macondo Investigation Report , Volume 3 [61, pp. 233-241], and CSB BP Texas City 
Investigation Report [60, pp. 142-195]. 

c At DuPont La Porte, first-line supervisors include shift supervisors. 
d Original comment was written using all capital letters. 
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DuPont has always been a strong leader in safety principles for the industry that we work in. The 
[La Porte] plant has a strong leadership for safety yet sometimes the message does not always 
get across to the employe[es]. Some still feel that production is above safety yet all managers 
have stated and demonstrated that production is far down the list when it comes to safety. 

I believe our “passion” for safety has slipped over the past 10 years. I believe this has impacted 
[our] ability to consistently achieve safety excellence. I interact with safety professionals from 
many companies in our area and my opinion is that, as a company, we are no longer the safety 
leader we were once thought of as. 

Despite concerns about its safety culture expressed by multiple levels of personnel within the organization, 
DuPont La Porte did not use these comments to take corrective actions that would institute process safety 
culture change at the DuPont La Porte facility. 

In 2014, DuPont La Porte hired an organizational consultant to increase production in the Lannate® Unit. Safety 
concerns resembling the ones from the 2012 Safety Perception Survey were raised again. According to an 
interview of a front-line supervisor in July 2014, four months before the incident, 

“...we just are not as good as we think we are.... not in pay, benefits, safety, etc.... We used to 
sell the safety program. We spend more time on driving incidents down, to keep the number 
down. We just have to make it look good. Don’t need to report every detail. Long slow slide— 
may not even notice how far we have fallen. 

This supervisor also noted in that interview that DuPont La Porte was at its most vulnerable point because 
younger engineers were most impressed by improved production, and “safety first” was not always the practice. 

Had DuPont La Porte formally assessed its process safety culture and taken effective corrective actions, cultural 
weakness that contributed to significant and long-standing process safety program deficiencies, which the CSB 
determined were causal to the November 15, 2014 incident (listed below), may have been identified, 
communicated, and addressed. These deficiencies are discussed in further detail in the CSB Interim 
Recommendations report on the incident [1] and Section 6: 

• Poor hazard analysis practices. Site personnel did not perform a hazard analysis on the 
troubleshooting techniques that they used leading up to the incident. Additionally, the DuPont La Porte 
site did not adequately analyze hazards associated with the manufacturing building’s ventilation system 
in PH As. A PH A on the ventilation system could have evaluated the ability of the fans to handle toxic 
releases and established more robust management systems to protect workers when a fan was broken [1, 
pp. 47; 25-26]. 

• Poor design of the manufacturing building. DuPont housed the Lannate® process inside a 
manufacturing building. The building design increased hazards for the workforce by confining toxic 
chemicals indoors. The building’s ventilation design also did not consider chemical toxicity hazards 
inside the building [1, p. 33]. 
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• Failure to maintain safety-critical equipment. Two “PSM critical”* ventilation fans were not 
operational at the time of the incident [1, pp. 33-35]. DuPont recognized that a ventilation fan 
breakdown could result in a high-consequence event. Both fans, however, exhibited poor reliability. 
One fan had been down since June 2014, five months prior to the incident, due to an electrical problem. 
On October 20, 2014, the other fan was making a noise significant enough that DuPont operators turned 
it off and wrote an “urgent” b work order to have it repaired [1, p. 20]. Even had the fans worked, they 
probably would not have prevented a lethal atmosphere inside the building due to the large amount of 
toxic gas released [1, p. 3]. 

• Failure to develop written procedures for operator actions. DuPont La Porte did not establish a 
formal procedure for draining liquid from the waste gas vent header piping, aside from its line-breaking 
policy (Section 6.5). In addition, when the DuPont Technical Team met to discuss how to clear the 
plugging in the piping system, they did not develop a written procedure for the techniques used to clear 
plugging in equipment, even though the plugging formed where it had never been before [1, p. 25]. 

• Lack of hazard recognition. The methyl mercaptan detectors installed in the manufacturing building 
were not intended for worker safety—the alarms were set to alarm at 25 parts per million (ppm), which 
was above OSHA’s ceiling limit 0 of 10 ppm. Operators also normalized smelling methyl mercaptan 
because of its low odor threshold and perceived lack of negative health impacts at those low 
concentrations, even though it is a toxic chemical. Although formally trained, d numerous employees 
lacked a working knowledge of methyl mercaptan’s hazards and did not recognize that the chemical 
could be both lethal and explosive. As a result, operators often confirmed methyl mercaptan leaks by 
purposely smelling for the chemical’s odor * * * * * 6 without understanding the dangers of this practice. 
Furthermore, this method of leak confirmation is a poor, unsafe, and unreliable practice that could have 
been replaced by using portable monitors set at appropriate levels [1, pp. 37-39]. 

Further, as the CSB concluded in its 2005 BP Texas City investigation, personal safety performance is not an 
effective gauge of process safety performance [60]. Similar to its investigation findings from BP Texas City, 
the CSB found that DuPont La Porte also focused on personal safety and did not place enough emphasis on its 
process safety programs. For example, the Safety Perception Surveys used at the DuPont La Porte facility 
evaluated only the perception of personal safety performance and did not identify process safety weaknesses at 
the facility. Even though DuPont La Porte was aware of the importance of BP Texas City’s findings, before the 


a DuPont assigns the designation of “PSM Critical” to equipment whose failure could result in a high-consequence event [1, p. 34]. 

b While the timing required to complete an “urgent” work order is not specifically defined, based on CSB’s review of DuPont records and 

interviews conducted with DuPont employees, it has a practical meaning of two to three days. 

6 The ceiling limit for a substance is the concentration that must never be exceeded under OSHA ( 29 C.F.R. § 1910.1000(a)(1) (2016)) . 

d DuPont La Porte included a toxic fume release and methyl mercaptan procedures in its emergency response plan. 

6 The DuPont La Porte facility had an emergency response procedure for a methyl mercaptan leak. If a leak was detected, personnel were 
required to put on an air demand mask and contact a supervisor or the control room to sound a plantwide fume alarm. 
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incident it continued to use the Safety Perception Survey without conducting additional formal process safety 
culture assessments that could identify process safety weaknesses. 

5.4.1.3 DuPont's Initiation of Process Safety Culture Assessments 

DuPont La Porte’s safety culture assessment program (the Safety Perception Survey) before the November 2014 
incident focused on lowering its OSHA total recordable injury rate. Even as the industry concentrated on 
improving process safety following the 2005 BP Texas City incident, and DuPont’s consultant arm developed 
process safety questions for the survey, DuPont La Porte lagged and did not incorporate DuPont’s process safety 
questions into its Safety Perception Survey. a Furthermore, DuPont La Porte did not formally assess aspects of 
its culture beyond the Safety Perception Survey. 

In 2017, however, DuPont required each site to assess its process safety culture periodically and added process 
safety questions to the Safety Perception Surveys. b This shift in incorporating process safety culture questions 
in its Safety Perception Surveys is important because, as explained in Chapter 6.2 of Volume 3 of the CSB’s 
Macondo report, the accuracy of a site’s culture assessment may be called into question if all aspects of culture 
are not considered as part of the assessment [61, pp. 236-238]. Furthermore, DuPont practice has become more 
aligned with its corporate philosophy that a process safety management program is only as effective as its safety 
culture. The CSB views the adoption of process safety culture questions in DuPont’s Safety Perception Survey 
as a positive development. 

Guidance to Industry 

The CSB has investigated several major incidents caused by weaknesses in process safety culture. 0 In recent 
years, process safety culture has been studied as a component of the broader topic of organizational culture, an 
analytical approach that the CSB first articulated in Volume 3 of its Macondo report [61, pp. 233-41]. 
Referencing the work of Sonja Haber and Edgar Schein, the CSB explained that organizational culture refers to 
characteristics of the overall environment, values, and rules that shape employees’ perceptions and attitudes [61, 
pp. 234-36]. This analytical framework extends to a culture for process safety, as these same varied components 
work together to determine the importance that an organization places on process safety. A “safety culture” is 
thus often accurately described as “the way we do things around here,” or “how the organization behaves when 
no one is watching” [62, pp. 9-10]. The chemical process industry then further defined process safety culture as 


a DuPont corporate conducted Safety Perception Surveys at all of its manufacturing sites. It chose not to include process safety 
perception questions in these surveys. 

b DuPont changed some of its process safety culture questions and increased the number of questions from 13 to 14. In 2017, DuPont 
updated its corporate process safety management standard to require each site to evaluate the process safety culture survey results and 
identify opportunities for improvement. 

c Other CSB investigations in which a weak process safety culture was found to contribute to the incident include Williams Geismar 
Olefins Plant Reboiler Rupture and Fire [71, p. 52], CSB Macondo Investigation Report, Volume 3 [61, pp. 233-241], and CSB BP Texas 
City Investigation Report [60. pp. 142-195]. 
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“the common set of values, behaviors, and norms at all levels in a facility or in the wider organization that affect 
process safety” [63]. 

According to CCPS, a sound or positive safety culture is “the pattern of shared written and unwritten attitudes 
and behavioral norms that positively influence how a facility or company collectively supports the successful 
execution and improvement of its Process Safety Management System (PSMS) resulting in preventing process 
safety incidents” [56, p. 6]. Additionally, a company’s espoused commitments and values, its messages from 
management to its workforce and the public, the quality of its written safety management programs, and the 
effectiveness of the implementation of those programs in sound operations are all paramount.* 

In its book Guidelines for Risk Based Process Safety , CCPS identified six themes of process safety culture: 

• Maintain a sense of vulnerability 

• Combat normalization of deviance 

• Establish an imperative for safety 

• Perform valid/timely hazard/risk assessments 

• Ensure open and frank communications 

• Learn and advance the culture [56, p. 23], [52, pp. 39-66] 

CCPS expanded on these process safety culture themes in Guidelines for Risk Based Process Safety and 
developed 10 core principles of process safety culture in Essential Practices for Creating, Strengthening, and 
Sustaining Process Safety Culture [56, p. 23]. To successfully implement the process safety culture principles 
in Figure 21, the later principles should build upon the earlier principles because each principle depends on the 
others [56, pp. 24-25]. 


a CCPS focuses on the quality of programs and the fidelity to those programs as “Conduct of Operations” and “Operational Discipline,” 
respectively [63]. 
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1* Establish an 1mperative 
for Process Safety 


2 . 


3. Foster Mutual Trust 


5 . 


8. Defer to Expertise 


Provide Strong 
leadership 


4, Ensure Open and Frank 

Communications 


Maintain a Sense of 
Vulnerability 


6. Understand and Act 
Upon Hazards/Risks 


7. Empower Individuals to 
Successfully Fulfill their 
Safety Responsibilities 


9. Combat the 

Normalization of 
Deviance 


10. Learn to Assess and 
Advance the Culture 


►Production not possible 
without process safety 

► Leaders inspire others to 
process safety excellence and 
Walk the Talk 

►Everyone does what they say 
and says what they mean 

► Communication channels are 
open and encouraged and 
messenger not blamed 

►Healthy level of respect for 
hazards and risk of facility and 
company 

►Hazards and risks analyzed, 
controlled with appropriate 
safeguards, and managed 

► Workers have authority and 
resources to performed 
assigned process safety roles 

►Technical knowledge related 
to process safety valued and 
technical opinions accepted 

► Deviance from approved rules 
and standards never 
tolerated. 

►Cultuie lessons-leamed 
sought internally and 
externally. Learnings used to 
maintain and enhance culture. 


Figure 21. Excerpt from "Overview of Core Principles of Process Safety Culture," in CCPS, Essential 
Practices for Creating , Strengthening, and Sustaining Process Safety Culture [56, p. 24]. Source: 
CCPS. 


One tool to evaluate a facility’s process safety culture is the use of anonymous process safety culture 
assessments of staff These assessments have historically been conducted by surveying a site’s employees 
through multiple-choice questionnaires. Facilities may also use qualitative assessment practices that go beyond 
simple employee questionnaire surveys. Such process safety culture assessments include personnel interviews, 
focus group discussions, and detailed document analyses. In qualitative assessments, workers interact with 
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auditors, “using their own terms and concepts to express their point of view.... Intensive and in-depth 
information can be obtained using the [workers’] own language” [64]. 

Guidance published in recent years describes how to conduct process safety culture assessments of chemical 
process facilities. In 2011, Contra Costa County in California published a guidance document on conducting 
process safety culture assessments, and CCPS released the second edition of its book Guidelines for Auditing 
Process Safety Management Systems [65], [66]. Chapter 4 of the CCPS book provides detailed guidance for 
auditors evaluating an organization’s process safety culture [66]. Additionally, in 2018, CCPS published 
Essential Practices for Creating, Strengthening, and Sustaining Process Safety Culture, which details how to 
assess, develop, and sustain a process safety culture in relation to a company’s process safety management 
system [56]. a In developing a process safety culture assessment, companies should follow the findings of the 
Baker Panel and ensure that improved injury rates are not perceived as an indication of acceptable process safety 
performance. 13 

Process safety culture assessments are a tool for understanding a company’s overall commitment to process 
safety. Furthermore, companies can use the assessments’ findings to develop action items for continual 
improvement efforts. To ensure a strong culture of process safety, companies must address any process safety 
culture assessment findings not consistent with the core principles of their process safety culture. Leadership plays an 
important role in ensuring that deficiencies in the process safety culture are addressed. As Andrew Hopkins noted in 
his article “Why Safety Cultures Don’t Work,” improving an organization’s process safety culture flows from top 
management commitment and cascades down to managers and employees [67, pp. 1, 3-4]. Hopkins argued that 
companies with strong leadership will best achieve process safety excellence by establishing systems (including the 
use of leading indicators) that drive catastrophic accident prevention [48, pp. 1-3]. Such companies are better 
equipped to avoid or prevent major process safety incidents because, as Hopkins observed, such companies can better 
“identify the obvious precursors to catastrophe and get serious about eliminating them” [67, pp. 1, 3-4]. 


a Essential Practices for Creating, Strengthening, and Sustaining Process Safety Culture includes in an appendix that contains a sample 
process safety culture assessment protocol [56, pp. 343-380]. 

b The Baker Panel found that BP “mistakenly interpreted improving personal injury rates as an indication of acceptable process safety 
performance” (see Figure 20). 
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5.4.2 Using the Process Safety Management and Risk Model 
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Figure 22. DuPont's Process Safety Management and Risk Model [54, p. 2]. Source: DuPont 
Sustainable Solutions. 


DuPont created the Process Safety Management and Risk Model (also called the PSM Wheel) to represent 
visually how the last three steps (management leadership and commitment, implementing a comprehensive 
process safety management program, and operational discipline) should interact with each other, using a wheel 
to show that DuPont’s process safety management system integrates management leadership and commitment 
with operational discipline (Figure 22) [54, p. 2]. 

The second step in implementing DuPont’s process safety management system, management leadership and 
commitment, is at the center of the PSM Wheel. According to DuPont, it placed this core value at the center 
because it affects all aspects of a process safety management system, from forming and fostering a safety culture 
to implementing policies and providing resources for safety-related activities [54, p. 2]. Additionally, “the 
actions of all levels of management must support and reinforce strong PSM programs and accountability” [54, p. 
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2]. DuPont believes that visible top management involvement (i.e., “felt leadership”*) in safety systems, 
processes, and programs is necessary for their sustainability. In addition, it notes that felt leadership, 
commitment, and role modeling greatly influence employees’ interest in, understanding of, and value for safety. 

The third step in establishing DuPont’s process safety management system, Implementing a Comprehensive 
PSM Program, is in the spokes of the wheel. Each spoke represents one of 14 aspects of DuPont’s corporate 
process safety management program. 13 These spokes are divided into three groups: 

a. Facilities to handle and manufacture hazardous materials: 

1. Management of “subtle changes” 

2. Mechanical integrity 

3. Pre-startup safety reviews 

4. Quality assurance 

b. Technology of the process: 

1. Management of technology change 

2. Operating procedures and safe practices 

3. Process hazards analysis 

4. Process safety information 

c. Personnel who operate, maintain, and support the process: 

1. Auditing 

2. Emergency planning and response 

3. Management of personnel change 

4. Incident investigation 

5. Contractors 

6. Training and performance [68, p. 2] 


a DuPont defines “felt leadership” as a respect through action for the well-being of people. It is a building block in constructing trust and 
real-world relationships among employees, customers, shareholders, and communities [116]. CCPS also defined felt leadership in its 
CCPS Vision 20/20: “Felt leadership means that the executives and other leaders personally involve themselves in process safety 
activities. Employees know the executives care about process safety because of what they see and feel executives doing, not just by 
[what] they hear them saying. Felt leadership is leading by passionate example” [56, p. 31]. 

b Note that DuPont’s PSM Wheel does not include trade secrets and employee participation, which are elements of OSHA’s PSM 
standard. 
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The final step, Operational 
Discipline, is the rim of the 
PSM Wheel. DuPont defines 
operational discipline as “the 
deeply rooted dedication and 
commitment by every member 
of an organization to carry out 
each task, the right way, each 
time” [54, p. 2]. According to 
DuPont, operational discipline 
translates a documented 
process safety management 
system into tangible results 
(see Figure 23). Additionally, 

DuPont believes that it reflects 
the strength of an 
organization’s safety culture in 
making safety, health, and 
environmental (also known as 
SHE) systems effective and in 

providing observable results for preventing injuries and incidents [69, p. 58]. 


Figure 23. Excerpt from DuPont Presentation Titled "Developing a Robust PSM Framework 
at DuPont." This slide illustrates DuPont's perception of the characteristics of an effective 
operational discipline program that translates to operational excellence [118, p. 11]. 
Source: DuPont Sustainable Solutions. 



Operational Discipline - Characteristics 


DuPont Sustainable Solutions 


DuPont management uses the Process Safety Management and Risk Model at its sites, including DuPont La 
Porte, and sells its process safety management system to other companies. 


5.5 DuPont's Process Safety Management System Conclusions 


DuPont integrated the PSM standard, RMP rule, and Responsible Care into its corporate process safety 
management system. In addition to other requirements, these frameworks obligate companies to establish a 
comprehensive corporate process safety management system. As shown in this section, companies need to 
ensure that there is an adequate focus on the effectiveness of a corporate process safety management system and 
its corresponding safety program elements. Without sufficient focus, implementing a corporate process safety 
management system will likely not be enough to prevent major chemical incidents. At the DuPont La Porte 
facility, an inadequate focus on the effective implementation of the corporate process safety management system 
resulted in process safety management deficiencies that led to the November 2014 incident. The following 
section discusses some of the deficiencies in DuPont La Porte’s process safety management system. 


6 Process Safety Management Deficiencies 


As part of its investigation, the CSB evaluated DuPont La Porte’s implementation of its process safety 
management system at the site (see Appendix A: Causal Analysis). The CSB found that DuPont La Porte had 
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multiple deficiencies in its process safety management program elements that contributed to the incident, 
including process hazard analysis (PHA), auditing, management of change (MOC), operating procedures, and 
safe work practices. a This section details some of these process safety management system deficiencies at the 
DuPont La Porte facility. Section 4 discusses the deficiencies in DuPont La Porte’s emergency response 
program. 13 Additionally, the CSB found that DuPont La Porte’s incentive compensation program did not 
conform to the OSHA guidance that existed at the time of the incident. 

Even though DuPont and DuPont La Porte had extensive written policies, these policies did not translate into 
effective implementation of or adequate focus on the effectiveness of its process safety management system at 
the DuPont La Porte site. The CSB determined that a company’s development of its own process safety 
management system is critical to prevent major accidents. Companies should ensure that the safety program 
elements within their process safety management system are effective, fully implemented, and functioning as 
intended. 

6,1 Process Hazard Analysis Evaluation 

DuPont’s internal PHA training 
documents state, “historically, the 
most significant failure in PHAs, 
identified through the investigation 
of incidents in which a breakdown 
of the PHA element was found to be 
a key factor, is the failure to identify 
the specific sequence of events that 
led to the accident (e.g., either failed 
to ask the right What If question or 
failed to completely develop the 
hazardous event scenario).” 

Without identifying the full extent of 
a potential hazardous event scenario, 

PHA teams are not likely to develop 
adequate safeguards to mitigate a 
hazard. Figure 24. Where PHA is Located on DuPont's Process Safety Management and Risk 

Model (PSM Wheel) [54, p. 2]. Source: DuPont, with annotations by CSB. 

One of the causes of the highly toxic 
methyl mercaptan release was a lack 
of safeguards to prevent the methyl 



a Section 4 covers process safety management deficiencies related to emergency response. 

b The PSM standard requires companies to have either an emergency action plan or an emergency response plan. Although the standard 
does not detail requirements for an emergency response program, it incorporates by reference regulations that dictate requirements for 
emergency action plans and emergency response plans ( 29 C.F.R. § 1910.119(nV) . 
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mercaptan hydrate from solidifying in the feed piping. In one of the hundred-plus what-if scenarios considered 
in the 2011 PHA, the DuPont La Porte PHA team acknowledged the potential for methyl mercaptan hydrate to 
solidify in the feed piping. The PHA team identified a scenario in which water back-flowing into the methyl 
mercaptan feed system could cause the formation of methyl mercaptan hydrate (Figure 25). The consequence of 
this scenario was the hydrate plugging the methyl mercaptan feed piping. The team identified that heating 
would dissociate the hydrate and unplug the system, but it did not fully develop (evaluate) the potential hazards 
resulting from the plugging, including hazards caused by dissociating the methyl mercaptan hydrate. The PHA 
team assessed the plugging as presenting an unlikely, low-severity hazard, assigning it the lowest possible risk 
ranking. a As a result of this risk ranking, no additional safeguards or further protective actions were required to 
address this scenario. 


Seel ion P - Hazard Evaluation Worksheets 


Pttlll 

Equipment 

"WHAT IF..." OR 
EVENT 

Response liazard 

Consequences 

Safeguards 

F 

C 

RISK 

RECOMMENDATION] 

w****** 

[Redacted] 

MeSNa 

Cooler 

Back water into the 
Mesh header 

Plumage 

Tunis the mesh into a gel 
and causes it to plug. 
Ultimately by beating the 
line externally it will 
vaporize and rerum to mesh 
and water vapor. 

S23g This is part of tbe 
bask process control which 
tbe MeSNa cooler operation 
will not operate. 

1 

1 


No 

Recommendation 


Figure 25. CSB's Reproduction of the Hazard Evaluation Worksheet from the 2011 PHA. It that identified the methyl mercaptan 
hydrate formation as a hazard. Source: DuPont, with modifications by CSB for readability. 

As discussed earlier, the PHA team did not comprehensively evaluate this scenario. For example, it did not 
ensure that a procedure or safeguard existed to heat the piping safely. Figure 25 shows that the PHA team 
identified one existing safeguard for the hydrate plugging scenario—the company’s standard for backflow 
prevention. This safeguard, however, was inadequate because this standard addresses backflow from a process 
(MeSNa cooler) to a service or a utility (water supply). Therefore, applying this standard would not have 
prevented or offered protection from water flowing into the methyl mercaptan feed piping. 

Hence, the PHA team underestimated the risk, noting, “Ultimately by heating the line externally it will vaporize 
and return to [methyl mercaptan] and water vapor.” Even though the PHA team identified heating as a means to 
dissociate the methyl mercaptan hydrate, DuPont La Porte did not identify the need to develop a formal 
procedure or engineered system to safely heat the line and address the hazard the team had identified. As a 


a DuPont La Porte used a risk matrix that evaluated risk by assessing consequence and frequency. The DuPont La Porte PHA team 
assigned the lowest-level possible consequence (C-l) and frequency (F-l) to the methyl mercaptan hydrate. This assignation resulted in 
the methyl mercaptan hydrate having the lowest possible risk (IV), which meant the PHA team did not have to mitigate the hazard. A C- 
1 consequence equates to no significant injury or health impact on-site or off-site and no significant environmental impact. As long as 
the consequence was classified as C-l, the frequency of the event would not have mattered; the PHA still would not have had to mitigate 
the risk. 
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result, on November 14, 2014, the DuPont Technical Team had to develop a troubleshooting plan to address the 
hydrate plugging (Section 6.3). This plan was developed without performing any hazard analysis, developing a 
written procedure, training personnel, or providing sufficient technical resources for the night shift. 

Although DuPont La Porte’s 2011 PH A of the process identified methyl mercaptan hydrate formation, a the PHA 
team did not recognize the need to address the potential methyl mercaptan hydrate formation risk by providing 
additional safeguards, such as heat tracing, b or to develop a written procedure to safely dissociate the hydrate 
(see Section 6.3). When critically evaluating any PHA scenario following a major accident, it is not uncommon 
to identify how a PHA team could have recommended additional or more effective safeguards. The difficulty 
PHA teams face is how to ensure that what is perceived as “good enough” when evaluating a potential hazard 
scenario will ultimately provide sufficient protection (effective risk mitigation). Had DuPont La Porte installed 
effective safeguards, such as heat tracing, to maintain the piping contents above 52°F, the facility could have 
avoided the abnormal situation that led to the deaths of four workers. Following the November 15, 2014 
incident, DuPont completed two new baseline PHAs using a more robust PHA methodology for the Insecticide 
Business Unit. Despite performing PHAs for more than 30 years, DuPont La Porte employees told CSB 
investigators that the improved approach for conducting PHAs was resulting in hundreds of action items, never 
previously identified, to control hazards. Difficulties in performing PHAs highlight the importance of having a 
strong process safety culture foundation to drive site personnel to effectively respond to real-time events with 
robust process safety management system programs, including MOCs or safe work practices. 

Guidance to Industry 

PHAs can be subjective and can result in underestimating the risk of potential hazardous event scenarios. 
Because in PHAs the assignment of event frequencies and consequence severities can make a significant 
difference in safeguard requirements, companies need to ensure that PHA teams have a robust process and 
adequate resources in place to fully develop hazard scenarios and assign appropriate initiating event frequencies 
and consequence severities to them. Additionally, PHA teams need to ensure that the safeguards applied to the 
hazard scenarios are relevant and effective in controlling the hazards. 


a The methyl mercaptan hydrate hazard was also identified in DuPont La Porte’s technical standard (see Section 6.3). 
b “Heat tracing is used to prevent heat loss from liquids inside process piping in situations where low fluid temperatures could lead to 
problems such as an unacceptable increase in viscosity, hydrate formation, congealing or solidification, the separation of components, or 
when water in the line could form corrosive materials” [131, p. 157]. Heat tracing can be either steam or electrical heat applied to the 
surface of a pipe and covered by insulation [131, p. 158]. 
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6.2 Implementation of Corrective Actions 

According to OSHA’s Process 
Safety Management Guidelines for 
Compliance , taking corrective 
actions is one of the most 
important parts of an audit and 
includes identifying deficiencies, 
planning, following up, and 
documenting needed corrections 
[19]. Audits, PHAs, incident 
investigations, and emergency 
response drills are among the 
various PSM program elements 
that can generate corrective action 
items. At times, the corrective 
action program at DuPont La Porte 
did not appropriately correct gaps 
identified by site PSM audits 
(Figure 26). 

One of DuPont’s process safety metrics was tracking the completion of corrective action items. However, this 
metric addressed only one aspect of the site’s corrective action program—time needed to close the corrective 
action. Time to close corrective actions can indicate the priority management gives to completion of corrective 
action items. DuPont La Porte’s focus on time to complete, however, sometimes resulted in closing action items 
after developing a plan to correct a deficiency rather than actually correcting it. In Guidelines for Risk Based 
Process Safety CCPS states, 

A safety management system can be seriously deficient, yet appear satisfactory by superficial 

measures—the paperwork appears to be in place and no serious incidents have been recorded. 

Complacency replaces a sense of vulnerability, and the execution of program tasks becomes 

perfunctory [52, p. 639]. 

Similarly, based on its corrective actions metric, the DuPont La Porte facility did not appear to have a large 
number of process safety management deficiencies—while the CSB’s review of corrective actions at La Porte 
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Figure 26. Where Auditing is Located on DuPont's PSM Wheel [54, p. 2]. Source: 
DuPont, with annotations by CSB. 
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revealed that some corrective actions were closed without addressing the issue identified by the underlying 
recommendation.* As such, closing out some corrective actions became perfunctory paperwork closures. 

For example, in 2009, a second-party PSM audit found that the DuPont La Porte site lacked documentation 
showing the manufacturing building’s ventilation system b was ever tested to ensure it could effectively 
distribute fresh air within the building. Based on this finding, the audit recommended that the site set up a 
program to test the manufacturing building’s ventilation system periodically. 

The two sides of the manufacturing building were separately ventilated by dilution air exhaust fans located on 
the roof of the building. The dilution air ventilation system design used roof-mounted fans to pull fresh dilution 
air into the manufacturing building. Fans drew fresh air into each floor on each side of the building, at floor 
level, through a mechanical louver system. 0 When the system operated properly, air would flow from the fresh 
air louvers, across the process equipment, and up into return ducts on the ceiling along the internal wall to sweep 
away any flammable or toxic gases. d Exhaust air from each side of each floor moved inside the ceiling-mounted 
duct toward the north end of the building (Figure 27), where it was collected in a vertical duct header that 
directed the exhaust air from all of the floors on each side up to the respective (wet or dry end) dilution air 
exhaust fan on the roof. Exhaust air from the fans discharged directly to atmosphere. The ventilation system 
was not equipped with any kind of environmental destruction system, such as a scrubber or incinerator, to 
remove contaminants. 


a The CSB found multiple incidents at the DuPont La Porte facility in which corrective actions were closed by sending emails to relevant 
parties without following up to ensure effective implementation (e.g., coordination with other companies located on-site, deviation from a 
highly toxic material requirement, etc.). 

b The stated design objective for the ventilation system is as follows: “The main objectives of industrial ventilation for the LANNATE®/ 
[agricultural products intermediates] manufacturing building are to: a. control contaminants to acceptable work place exposure levels, 
e.g., comply with OSHA regulation or Corporate AELs (acceptable exposure limits), and b. prevent fires and explosions.” The actual 
design calculations, however, do not take toxicity into consideration. In addition, DuPont has not established an AEL for methyl 
mercaptan [1, p. 33]. 

c The louver is a set of angled slats or flat strips fixed or hung at regular intervals in a shutter to allow air to pass through [1, p. 13]. 
d DuPont La Porte records indicate that the manufacturing building ventilation system design code is National Fire Protection 
Association (NFPA) 497, Recommended Practice for the Classification of Flammable Liquids, Gases, or Vapors and of Hazardous 
(Classified) Locations for Electrical Installations in Chemical Process Areas. NFPA 497 defines adequate ventilation as that sufficient 
to ensure that the concentration of flammable gases does not exceed 25 percent of the lower flammability limit (also called the lower 
explosive limit (LEL)). DuPont’s methyl mercaptan safety data sheet indicates that the LEL for methyl mercaptan is 3.9 percent [1, p. 

13]. 
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Return Ducts 



Fresh Air Inlets 


Figure 27. Simplified Graphical Representation of a Typical Floor of the Manufacturing Building. It shows how fresh 
air was pulled in from the outside walls, swept across the floor, and entered the exhaust return air ducts on each 
side. Source: CSB. 

To close the action item generated—to ensure the ventilation system was routinely tested—DuPont La Porte 
personnel created a program within their computerized maintenance system that periodically generated a work 
order to conduct dilution air flow testing [1, p. 34]. DuPont La Porte closed the corrective action in March 2010 
after creating this program. But the CSB found serious deficiencies in the implementation of this program: 

• DuPont La Porte personnel were supposed to schedule the first ventilation system test in November 
2010. This test was delayed and did not occur until two years later, in 2012 [1, p. 34]. This delay 
occurred in part because personnel closed the corrective action without assigning a specific individual 
to ensure completion of the ventilation testing. 

• On the dry end side of the building, DuPont La Porte personnel measured dilution air flow without 
analyzing the data or establishing acceptable air flow criteria. Additionally, they never measured the 
air flow on the wet end side where the November 15, 2014 release occurred. Therefore, DuPont La 
Porte never verified whether the manufacturing building’s ventilation system could effectively remove 
flammable or toxic chemical leaks. 

Had the corrective action met the intent of the PSM audit recommendation, the need for additional safeguards in 
the manufacturing building (e.g., a better ventilation system, increased chemical detectors, respiratory 
protection) should have been evaluated. Effective ventilation system testing and analysis should have identified 
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and corrected poorly ventilated areas to reduce worker hazards posed by potential flammable or toxic gas leaks 
in the manufacturing building. a 

At the time of the November 2014 incident, neither the wet end nor the dry end fans were functioning. Had the 
deficiencies in the DuPont La Porte ventilation system been recognized, access to the manufacturing building 
should have been restricted 13 and personnel could have been required to wear SCBAs inside it. Adequate 
safeguards could have protected workers when the fatal toxic release occurred. 

Closing corrective action items with only a limited plan to address an audit finding is a poor practice—it can 
result in the action item’s being implemented ineffectively or not at all. At DuPont La Porte, even though 
personnel closed as complete the ventilation system testing action item, they never completed the testing to 
ensure the effectiveness of the ventilation system. 

Guidance to Industry 

Companies should ensure that their corrective actions meet the intent of their recommendations. One way to 
make the intention of the recommendation the focus of any follow-up activity is to evaluate the substance of the 
corrective action in addition to the time it takes to complete the action. 


a For more information on the ventilation systems, see the Interim Recommendations report ( CSB DuPont La Porte Interim 
Recommendations [1, pp. 12-16]). 

b The CSB Interim Recommendations report discusses how DuPont La Porte’s emergency procedures called for restricting access to the 
manufacturing building if a ventilation fan, such as the wet end or dry end fans, is out of service. However, the actual practice for 
manufacturing building access was no different with a fan out of service than if all the fans were operating [1, p. 35]. 
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63 Process Safety Practices during Troubleshooting Operations 

A robust strategy for troubleshooting 
is important because if hazards are not 
identified before starting an activity, 
workers could be unprepared for 
dealing with them, like what happened 
during the November 2014 incident. 

Troubleshooting implicates multiple 
PSM elements, including management 
of change, operating procedures, and 
safe work practices (Figure 28). 

Although DuPont La Porte had written 
policies and procedures for MOCs, 
operating procedures, and safe work 
practices, it did not have a strong 
process safety approach for dealing 
with troubleshooting operations. 

During the morning of November 14, 2014, Lannate® Unit engineers and managers (Technical Team) met as a 
group with the day shift supervisor to discuss the plugging problem in the methyl mercaptan piping and to 
develop a troubleshooting plan for clearing the piping and restarting both the Lannate® and agricultural products 
intermediates processes [1, p. 23]. In this meeting, the Technical Team identified the likely scenario that water 
had entered the methyl mercaptan system, developing a solid hydrate. DuPont’s methyl mercaptan technical 
standard shows the potential formation of a hydrate at low temperatures. The technical standard states that 
methyl mercaptan “will form a hydrate with water, which is a solid below [40°F [degrees Fahrenheit]] per 
information provided by a [methyl mercaptan] supplier” [1, p. 23]. 

Prior to implementing the troubleshooting plan developed by the Technical Team, however, site personnel did 
not develop written procedures, conduct any type of hazard analysis for abnormal conditions, conduct a job 
safety analysis, perform an MOC process, or conduct any other type of hazard analysis [1, p. 25]. Several 
methods can identify potential hazards and prevent or mitigate potential incidents caused by troubleshooting, 
including development and use of MOC processes, operating procedures, or safe work practices. A robust 
troubleshooting approach can include the following methods: 

• An MOC approach, which should identify and address possible hazards [52, pp. 423-426, 255-256] 

• An operating procedure approach, which should incorporate safeguards while methodically working 
through troubleshooting steps [52, pp. 255-256] 





Figure 28. Where troubleshooting Could Fall on DuPont's PSM Wheel [54, p. 
2]. Source: DuPont, with annotations by CSB. 
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• A safe work practices approach, which should address unexpected process upsets by using work permits 
(i.e., line-breaking permits) that can address specific troubleshooting hazards [70, p. 393], [52, pp. 285- 
298] 

A combination of these PSM approaches may be prudent depending on the complexity and urgency of the 
problem. One or more of the noted PSM approaches could have identified the pathway the liquid methyl 
mercaptan took into the manufacturing building before personnel put hot water on the insulated piping, leading 
to the November 2014 incident. 


Guidance to Industry 

Companies should develop an action plan to manage troubleshooting operations. There are multiple approaches 
a company can take, including addressing troubleshooting hazards in PHAs, operating procedures, MOCs, or 
work permits. 


6.4 MOC Practices 

According to OSH A, “contemplated 
changes to a process must be 
thoroughly evaluated to fully assess 
their impact on employee safety and 
health and to determine needed 
changes to operating procedures” 

[18]. Therefore, to prevent safety 
incidents and ensure worker safety, 
companies must ensure that the 
following considerations are 
addressed in their MOC process 
prior to the implementation of any 
change: 

• The technical basis for the Figure 29. Where MOC is Located on DuPont's PSM Wheel [54, p. 2]. Source: 

proposed change DuPont, with annotations by CSB. 

• Impact of the change on employee safety and health 

• Modifications to operating procedures 

• Necessary time period for the change 
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• Authorization requirements for the proposed change [18] a 

As explained in the CSB’s Williams Geismar Olefin Plant Case Study , robust management of change practices 
are needed to ensure that personnel review hazards for the entire process affected by the change [71, p. 23]. 
Within DuPont, MOC policies are defined in standards at the corporate level and adopted according to each 
site’s procedures. The DuPont corporate standard defines three types of MOCs: technology, subtle changes, and 
personnel (Figure 29). An MOC for technology is defined as “any change in the technology of the process.” 13 A 
“subtle change” is defined as “any change within the documented technology that is not a replacement in kind.” 0 ’ 
d MOCs are intended to be completed prior to any implementation of these types of change. DuPont La Porte 
adopted DuPont’s corporate MOC policies into its own site policies and procedures. The CSB found, however, 
that DuPont La Porte personnel did not use MOCs for changes to equipment or procedures that contributed to 
the incident. 

6.4.1 No MOC for Heating Piping or for New Piping Alignment 

To clear the plugging, the Technical Team asked operators to put hot water on the outside of the methyl 
mercaptan feed piping, under the insulation, to warm the piping and its contents to dissociate the hydrate back to 
liquid methyl mercaptan and water (Figure 30) [1, p. 23]. 


a 29 C.F.R. $ 1910.119 (11(2) . 

b According to DuPont, management of change of “subtle changes” includes rerouting a piping system during field modifications or 
replacement and installation of an automatic valve to replace a manual valve with the same function. 

c According to DuPont, management of change technology includes managing changes in the design basis for existing equipment, 
changes in process materials or operating parameters, and process control changes. 

d In its Belle investigation, the CSB recommended that DuPont “[rjeevaluate and clarify the DuPont corporate MOC policies to ensure 
that staff can properly identify and use the distinctions between subtle and full changes and train appropriate personnel how to properly 
apply the distinctions on any changes in the policy.” [144, p. 110]. The CSB closed the recommendation in April 2013 [147]. 
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Figure 30. Hot Water Hose Positioned on the Liquid Methyl Mercaptan Feed Piping. Hot water flowed 
between the piping and the insulation to heat the piping and dissociate the solid hydrate that had formed 
after water inadvertently entered the methyl mercaptan storage tank. Source: CSB. 

At low temperatures (< 52°F), water and methyl mercaptan form a solid, ice-like material called methyl 
mercaptan clathrate hydrate [72]. Temperatures in the Houston area for the 24 hours preceding the incident 
averaged approximately 40°F and had been consistently below 55°F since Tuesday, November 11, 2014. 
Although years earlier, DuPont’s methyl mercaptan technical standard and a PHA identified the potential for 
methyl mercaptan hydrate formation, DuPont did not have safeguards, such as heat tracing, or develop a 
procedure to dissociate the hydrate safely [1, p. 22]. 

The Technical Team realized that when methyl mercaptan was heated it would expand and need a safe place to 
vent to avoid overpressure in the feed piping. To address this concern, DuPont operations personnel opened 
three valves between the methyl mercaptan feed line and the waste gas vent header—piping intended to remove 
excess or unwanted vapor from the process and route it to the NRS incinerator for thermal destruction. DuPont 
La Porte personnel used pressure gauges at those three valves (Figure 31) to determine the location of the 
blockage and their progress in clearing it. At the time of the incident, one of these three valves between the 
methyl mercaptan feed system and the waste gas vent header was fully open, and a second valve was slightly 
open [1, p. 25]. 
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Figure 31. Excerpt from CSB Animation. It depicts the three locations where valves connected the methyl mercaptan feed piping 
(blue) to the waste gas vent header piping (orange). Workers used the pressure gauges shown at these locations to monitor the 
progress of clearing the hydrate blockage inside the methyl mercaptan feed piping. Source: CSB. 


Operations personnel began implementing the plan that the Technical Team had developed by applying hot 
water under the insulation, on the outside of the liquid methyl mercaptan piping. DuPont La Porte operators 
started this process at the methyl mercaptan storage tank and the associated methyl mercaptan feed pump piping 
segments, and then worked their way down the methyl mercaptan feed piping toward the reaction system. 
Workers used pressure gauges at each of the three block valves between the liquid methyl mercaptan feed piping 
and the vapor waste gas vent header piping system to determine the success and progress of the work [1, p. 26]. 
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Figure 32. Excerpt from CSB Animation. It depicts the piping arrangement that allowed liquid methyl mercaptan from the 
feed line (blue) to flow into the waste gas vent header piping (orange). Source: CSB. 


Using these valves in this way followed the plan developed by the Technical Team. This alignment, however, 
created a direct path between the liquid methyl mercaptan system and the waste gas vent header (vapor system), 
as shown in Figure 32, which was not DuPont’s design intent [1, p. 26]. Additionally, applying hot water to the 
outside of the methyl mercaptan liquid piping system exceeded the heat input design for the thermal expansion 
relief valve on this system [1, p. 26]. But DuPont La Porte personnel did not perform an MOC before 
instructing operations personnel to use the hot water to heat the piping, or before creating the piping alignment. 
DuPont corporate standards, as well as the EPA’s Risk Management Plan (RMP) rule and OSHA’s PSM 
regulations, require an MOC for these types of process changes [1, p. 25]. Performing an effective MOC before 
heating the piping with the hot water hose, and before creating the unusual piping alignment, could have 
identified and controlled the hazards that led to the incident. 

An MOC should have also triggered the creation of a written troubleshooting procedure. On the day of the 
incident, the Technical Team did not provide a written procedure to guide operations or to track the progress 
toward clearing the plugged methyl mercaptan feed piping. A written procedure should communicate the 
planned approach to multiple shifts and help avoid confusion. Additionally, it should alert personnel to potential 
hazards, such as the valve alignment that created the pathway for liquid methyl mercaptan to flow into the 
manufacturing building. 
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6.4.2 No MOC for New Piping Alignment to Nitrogen Relief Valves 

During the troubleshooting operations, the nearly identical nitrogen relief systems located at two railcar loading 
and unloading stations were lined up to the discharge of the methyl mercaptan pumps (Figure 33). The nitrogen 
relief valves, however, were not designed for this new piping alignment. DuPont La Porte PHAs and relief 
valve design documents did not consider the possibility of lining up the methyl mercaptan storage tank pumps to 
these relief valves—as they were at the time of the incident. As a result, liquid methyl mercaptan discharged 
from a system designed for nitrogen vapor because the methyl mercaptan pump discharge pressure (90 psig) a 
was higher than the set pressure (80 psig) of these nitrogen relief valves. Pressurized methyl mercaptan from 
the pump caused the relief valves to open and release the highly toxic and highly flammable methyl mercaptan 
to the atmosphere [1, p. 46]. No one recognized this serious hazard because DuPont La Porte personnel did not 
perform an MOC when it changed the piping alignment during troubleshooting operations. An effective MOC 
should look at the design basis for equipment to determine whether the proposed use is compatible with its 
design. 


a The abbreviation psig stands for pounds per square inch gauge (pressure). 
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Figure 33. Nitrogen Relief Valves at One of the Two Methyl Mercaptan Railcar Unloading Stations. DuPont PHAs and 
relief valve design documents never considered the possibility of lining up the methyl mercaptan storage tank pumps 
to these relief valves—as they were at the time of the incident. As a result, liquid methyl mercaptan was discharged 
from a system designed for nitrogen vapor. Source: CSB. 


6.4.3 No MOC or Procedure for Vent Header Draining Operation 

In 2011, DuPont La Porte invested about $20 million in a project to increase production rates and reduce 
environmental emissions for the Insecticide Business Unit. a The key piece of equipment installed for this 
project was the nitrogen oxides (NO x ) reduced scrubbed incinerator (NRS) shown in Figure 34. b 


a Lannate® was a sold-out product, and DuPont routinely looked for opportunities to increase capacity [1, p. 17]. 
b The NOx (nitrogen oxides) reduced scrubbed (NRS) incinerator system was a vertical thermal oxidizer system for the destruction of 
organics, halogenated organics, and nitrogen-containing wastes with removal of acid gas from discharge [1, p. 18]. 
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Figure 34. NRS Incinerator. NRS was installed in 2011 to reduce emissions and allow 
increased production at the DuPont La Porte facility. Source: CSB. 

The NRS incinerator destroyed process waste gas streams that vented from equipment throughout the process. 
One of these waste gas streams contained methyl mercaptan vapor collected in a process vent system, referred to 
as the waste gas vent header piping. This header originated from various Lannate® and agricultural products 
intermediates process vessels, from methyl mercaptan railcar unloading facilities, and from the methyl 
mercaptan storage tank. The waste gas vent header piping provided the path for these waste gas streams to be 
directed to the NRS incinerator for thermal destruction (combustion) [1, p. 18]. 

Following the 2011 installation of the NRS incinerator, DuPont experienced frequent high-pressure events in 
equipment connected to the waste gas vent header piping. a DuPont decided one significant cause of these high- 


a The high pressure in the waste gas vent header piping restricted vent sources flowing into the header, causing high-pressure events in 
process equipment. If left unaddressed, these high-pressure events could result in relief valves’ opening and discharging hazardous 
chemicals to the atmosphere [1, p. 18]. 
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pressure events was liquid accumulation in the vapor waste gas vent header piping. a DuPont La Porte personnel 
had designed and installed the waste gas vent header piping to the NRS incinerator in 2011 without sufficient 
consideration of liquid accumulation. For example, the piping had low points where liquid could accumulate, 
and with no engineered equipment provided, such as a knock-out drum, b liquids could not be safely removed 
from the waste gas vent header piping system. 0 Because some of the process vents contained water vapor, the 
common belief was that the accumulated liquid consisted primarily of condensed water with small amounts of 
other process chemicals, including methyl mercaptan. As a result, area management instructed operations 
personnel to address high-pressure events in the waste gas vent header piping by opening manual drain valves 
from the waste gas vent header piping to the atmosphere, directing the liquid toward floor drains located within 
the manufacturing building [1, p. 18]. 

DuPont La Porte personnel never completed an MOC or established a specific procedure or used safe work 
practices, such as line-breaking permits, for draining this liquid from the waste gas vent header piping. Rather, 
area management directed operators to drain the system through written instructions to operations staff in a daily 
instruction log book [1, p. 18]. Beginning January 14, 2014, and continuing until the incident, the daily 
instructions directed operators to drain the methyl mercaptan waste gas vent header’s “low point” on the third 
floor once per shift. After installation of a flexible hose from the waste gas vent header drain valve to the floor, 
the instructions changed to include directing the liquid through the hose under a running safety shower until the 
liquid stopped flowing from the hose [1, p. 18]. 

DuPont La Porte personnel never sampled or analyzed the liquid workers routinely drained from this system [1, 
p. 18]. Daily instructions before the incident asked the operators to sample the unknown liquid. DuPont La 
Porte wanted samples of the liquid for a subsequent laboratory analysis to identify its chemical composition 
because workers reported that the liquid had a strong, noxious odor of sulfur compounds [1, p. 18]. Even 
though DuPont La Porte was aware that the liquid likely contained more than just water and was unaware of the 
actual chemical composition [1, p. 18], instructions to workers did not specify that additional precautions—such 
as wearing additional personal protective equipment (PPE)—were needed when draining the waste gas vent 
header. 

Weeks before the November 2014 incident, DuPont La Porte employees started an MOC to reduce liquid 
buildup by connecting a hose from the waste gas vent header piping to a process vessel, thus eliminating the 
need to drain the header liquid onto the floor. This MOC recognized that draining the waste gas vent header on 


a DuPont personnel believed the likely source of liquid accumulation was condensation from saturated vapor streams that originated in 
equipment operating above ambient temperatures. As these vapor streams entered the cooler waste gas vent header, liquid could 
condense and accumulate over time [1, p. 18]. 

b Knock-out drum is an industry term for a process vessel that provides for separation of vapor and liquid. 

c The CSB identified three locations in the waste gas vent header piping to the NRS incinerator where liquid could accumulate: (1) inside 
the manufacturing building, (2) the piping outside the manufacturing building as it passed through the MIC unit, and (3) at detonation 
arresters just prior to where the waste gas from the waste gas vent header entered the NRS incinerator. Each location was equipped with 
a drain valve—two locations had atmospheric drains and only one location’s drain was routed to a caustic scrubber [1, p. 18]. 
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the third floor was “not a good practice, since sometimes nitrogen is used to purge the line, which can lead to a 
nitrogen release inside the building.” Although area management recognized that this draining “was not a good 
practice” and could lead to a release of nitrogen, a the practice continued. Once personnel recognized the 
hazardous nature of this practice, the draining should have at least required additional safeguards, such as 
restricted access and respiratory protection. 

Guidance to Industry 

Companies should always use MOCs where required by corporate policy or federal process safety regulations. 
Special attention should be paid to nonroutine or abnormal operations because these may involve issues with 
safety systems, equipment, procedures, or personnel practices that can create additional hazards, potentially 
leading to serious safety incidents if there are poor MOC practices. Company MOC reviewers should be 
thoughtful and comprehensive so that potential dangers can be avoided or mitigated. 


a As an asphyxiant, nitrogen can displace oxygen, creating a potentially hazardous environment [168, p. 2]. 
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6.5 Line-Breaking Practices 



Management 
o* Technology Change 


Traming and Performance 


Management 
d “Subtle Changes* 


90 Wt 


Companies should ensure the use of 
safe work practices, a such as line- 
breaking permits, to manage 
nonroutine b processes, such as 
draining the waste gas vent header 
piping. Under the PSM standard, a 
company must develop and 
implement safe work practices to 
provide for the control of hazards 
during work activities, such as 
lockout/tagout, confined space entry, 
or opening process equipment or 
piping (i.e., line breaking). 0 
According to Guidelines for Risk 
Based Process Safety , from CCPS, 
safe work practices help control 
hazards and manage risks involved 

with nonroutine activities [52, p. 286]. Managing risks associated with nonroutine processes requires robust 
systems, thorough training and awareness, sound culture, and diligence [52, p. 293]. CCPS further suggests 
developing an integrated system for safe work practices, including safe work procedures, permits, checklists, 
and other written standards [52, pp. 291-92] (Figure 35). 

Any time a valve is opened to the atmosphere, the mechanical integrity of the system is compromised. Under 
PSM, employers must develop and implement safe work practices to control hazards during line breaking [18]. d 
Figure 36 shows an approach to line and equipment opening (breaking) from a document that was produced 
under OSHA’s grant program. 


Figure 35. Where Safe Work Practices Are Located on DuPont's PSM Wheel [54, p. 
2 \. Source: DuPont, with annotations by CSB. 


a CCPS defines safe work practices as “an integrated set of policies, procedures, permits, and other systems that are designed to manage 
risks associated with non-routine activities such as performing hot work, opening process vessels or lines, or entering a confined space” 
[150]. 

b CCPS defines a nonroutine activity as any activity that is not fully described in an operating procedure. Additionally, nonroutine does 
not refer to the frequency of an activity; rather, it refers to whether the activity is part of the normal sequence of converting raw materials 
to finished materials [52, p. 288]. 
c 29 C.F.R. $ 1910.119 (f)(4) . 

d According to OSHA, line breaking “means the intentional opening of a pipe, line, or duct that is or has been carrying flammable, 
corrosive, or toxic material, an inert gas, or any fluid at a volume, pressure, or temperature capable of causing injury” 29 C.F.R, § 
1926.1202, 
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Line and 


Equipment 


o pen! ns 


No Person may break into, open, or disassemble any equipment 
which MIGHT contain hazardous material, pressure or temperature 
until a L. E. O. permit has been completed. 


REVIEW 1. Hazardous Material 



Figure 36. Triangle Approach to Line and Equipment Opening Permits. This slide is from a training 
document about OSHA operating procedures, safe work practices, and training [73, p. 27]. 

Source: OSHA website. 

Employees at the DuPont La Porte facility understood that there were hazards associated with nonroutine 
procedures, such as line breaking. DuPont’s corporate standard, which was also DuPont La Porte’s line- 
breaking procedure, specifically includes opening a valve to the atmosphere in its definition of line breaking, 
which requires a written job plan if it involves a hazardous 3 process or system. b Personnel at the DuPont La 
Porte facility, however, did not understand that draining the waste gas vent header through the flexible hose 
constituted a line break and required a permit. To drain the header using the existing equipment and work 
instructions, operations personnel had no choice but to open a valve to let the liquid flow toward the floor drain 
(and thus to the atmosphere), breaking the mechanical integrity of the line. 


a DuPont line-breaking training defines a hazardous process or system as a “process or system that contains any material at any pressure 
that could cause a risk of injury to an individual(s), a risk of fire or explosion, an environmental risk, or an off-site risk. Examples of 
hazardous processes or systems include, but are not limited to, compressed fluids, especially gases in pipes and vessels; corrosive and/or 
flammable substances and toxic process lines; and any other lines that could contain material that is hazardous on contact or inhalation, 
including fluid whose temperature is higher than 140°F (60°C) or lower than 14°F (-10°C).” 

b DuPont’s corporate line-breaking standard and DuPont La Porte’s site line-breaking procedure states, “A written job plan that 
specifically addresses safety, health, and environment (SHE) issues shall be prepared and implemented for all line breaks on hazardous 
processes and systems until all hazards have been learned or controlled. The job plan shall be prepared by qualified personnel and 
reviewed by everyone involved in the work prior to the start of the line break.” 
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Although area management left written instructions, there was no written job plan and no specific requirement 
to obtain a line-breaking permit before draining the header. Had the instructions specified the requirement, the 
personnel could have recognized the need. a 



Figure 37. Photo Showing Another Line Break. Operators drained liquid accumulation in another vent header 
without using line-breaking procedures. Source: CSB. 

In addition to the periodic draining of the waste gas vent header, the CSB found that DuPont La Porte operators 
routinely drained other hazardous process equipment (see Figure 37 and Figure 38) without using line-breaking 
procedures. 


a At the DuPont La Porte site, if a procedure described how to do a line break and the appropriate precautions to take, personnel were not 
required to obtain a permit. 
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Figure 38. Methylene Chloride a Compressor. Photo shows where operators routinely drained liquid accumulation 
from a methylene chloride compressor without using line-breaking procedures. Source: CSB. 

In both February and October 2014, DuPont La Porte personnel held problem-solving meetings with two 
different shifts of operations personnel to discuss high-pressure events in the waste gas vent header, and both 
times personnel identified liquid accumulation in piping low points as well as draining liquid from the vent 
header. Additionally, both shifts proposed modifying piping to eliminate low points where liquid accumulated 
as a potential solution. These meetings, however, did not ensure that personnel were safely troubleshooting the 
high-pressure events. It is important for companies to recognize that problem-solving sessions are opportunities 
to evaluate hazards and ensure that MOCs, operating procedures, and safe work practices are being used. 

In situations with unknown conditions, safe work practices required by PSM provide an organized approach to 
proceed safely. Consistently using safe work practices, such as line-breaking permits, ensures that each time a 
piece of process equipment is put into a nonroutine situation, personnel use effective safeguards. Furthermore, a 
permit process can address procedures, hazard analysis, PPE, and safeguards. Additionally, if hazards are 
identified, corrective actions should be developed, and effective safeguards should be implemented. 

Guidance to Industry 

Companies should recognize that nonroutine operations such as line breaking—even with established permit 
processes—can represent significant potential dangers. One way to help ensure that personnel understand the 
permit process is to train them on the different scenarios that would trigger a permit. Companies should analyze 
recurring operational or safety issues that trigger permits and eliminate the underlying causes of those issues. In 


a Methylene chloride is a toxic chemical that can cause death at certain concentrations [93]. 


FINAL COPY 


Page 116 











U.S. Chemical Safety and 
Hazard Investigation Board 


Toxic Chemical Release at the 
DuPont La Porte Chemical Facility 

La Porte, Texas | Incident Date: November 15, 2014 | No. 2015-01-l-TX 


instances requiring repeated line breaking, a hazard analysis should be performed, and an engineering solution 
should be applied (following an effective MOC) to avoid recurrence of the hazard. 

6.6 Shift Communication Practices 

Companies should develop procedures 
and practices for effective 
communication among their personnel 
(Figure 39). Effective communication 
depends on reliable and complete 
information that is transmitted and 
received in a timely manner. 

Understanding the information is 
imperative for safe operations. 

In its Guidelines for Risk Based 
Process Safety, CCPS outlines several 
approaches for communications 
including formalizing 

communications between workers, Figure 39. Where Shift Communication Falls on DuPont's PSM Wheel [54, p. 2]. 

formalizing communications between Source: DuPont, with annotations by CSB. 
shifts, and formalizing communications 

between work groups. Depending on the type of communication and group involved, verbal or written 
communication may be appropriate. When verbal communication is used, there should be a sufficient dialogue 
to verify that the person receiving information understands it. Additionally, personnel can use log books and 
written communications to transmit particularly important information. Using a combination of these two 
methods can benefit operations, as the CCPS book notes in the section on how formalize shift communications 
[52, pp. 475-76]. 

During the troubleshooting operations, DuPont personnel relied upon verbal communications to convey the 
Technical Team’s plan to the incoming shift (the shift working at the time of the incident) [1, pp. 25-26]. Post¬ 
incident, it remains unclear what the prior shift communicated to the incoming shift about the Technical Team’s 
plan and the status of the troubleshooting, because this information was communicated only verbally/ 

According to a DuPont training, “An effective shift turnover is important for chemical operations to ensure 
continuity across operating shifts and ensure all operating personnel fully understand both normal and abnormal 
or unusual conditions within the operating area in order to avoid misunderstandings or lack of information.” 



a The only written communication to the night shift supervisor was a note in the shift log that stated: “Unplugging M[e]SH Header.” 
MeSH is DuPont’s abbreviation for methyl mercaptan [1, p. 26]. 
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Having continuity in operations from shift to shift ensures that processes run smoothly and equips workers 
coming on shift with information that helps strengthen process safety performance. 

During the troubleshooting operations, DuPont relied upon verbal communications at several key times: 

• The Technical Team’s verbal communication of the plan to the day shift supervisor [1, p. 25]. 

• The face-to-face verbal communication between shift supervisors to transition the efforts from the day 
shift to the night shift [1, pp. 25-26]. 

Reliance on verbal communication during this troubleshooting operation proved detrimental because this 
problem was novel, and the night shift supervisor (referred to in this report as the “Shift Supervisor”) was 
learning of the shutdown and subsequent startup difficulties for the first time when he came on shift. Although 
the Technical Team verbally communicated with the day shift supervisor, the Technical Team did not meet with 
the newly involved night shift supervisor, nor did it communicate verbally or in writing with the night shift 
operations personnel. Improved communication could have helped ensure continuity of the troubleshooting 
operation by better informing the night shift of all the relevant activities that had occurred during the week and 
the steps needed to continue with the troubleshooting process. 

It is important for a company to assess the type of communication necessary for effective information sharing 
between shifts and between departments or divisions of a company. The more complicated the process and the 
more novel the problem, the more imperative it is to have effective communication. Consideration should be 
given to using multiple modes of communication (including written communication) to ensure that all affected 
employees get the information they need to perform their jobs safely, within the broader context of other 
ongoing operational and process safety issues, to maximize the chance for continuity and safety in operations. 


Guidance to Industry 

Effective communication between different operational units at a facility, and between supervisors and workers 
on changing shifts, is critical to safety. Communication is necessary to convey the status of operations, ongoing 
changes, abnormalities, unusual operating conditions, or other relevant issues associated with chemical process 
equipment. The more complex the process involved, the greater the imperative to ensure that communication is 
effective. Reliance solely upon one form of communication, especially verbal communication, can leave the 
workforce vulnerable to potential gaps in information communicated, misunderstandings, or absence of critical 
information in what oftentimes can be an evolving situation. 

7 Additional Facts, Conditions, and Circumstances Identified 

The CSB is tasked with investigating and reporting “to the public in writing the facts, conditions, and 
circumstances and the cause or probable cause of any accidental release resulting in a fatality, serious injury, or 
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substantial property damages.” a This information is beneficial in promoting safe workplaces and helping to 
protect workers, the public, and the environment. 

The CSB identified numerous conditions and circumstances that existed at the time of the November 15, 2014 
DuPont La Porte incident. In September 2015, the CSB issued an Interim Recommendations report to address 
conditions and circumstances, some of which were causal to the incident, before the DuPont La Porte Lannate® 
facility restarted [1]. Similar to its Interim Recommendations, the CSB identified a condition and circumstance, 
DuPont La Porte’s employee incentive program, that could be strengthened to further promote safe workplaces 
at DuPont legacy sites. Section 7.1 addresses the guidance for incentive compensation programs that existed at 
the time, and the corresponding Guidance to Industry section covers newly published OSHA guidance and 
industry guidance. 

7.1 Employee Incentive Program 

Companies should ensure that safety incentive programs do not disincentivize personnel from reporting injuries 
or other deficiencies in process safety management systems. 13 The DuPont La Porte facility implemented a 
variable compensation (bonus) system called the La Porte Local Performance Based Compensation (LPBC) 
program. The LPBC, however, did not use process safety management performance metrics. Instead, it used a 
safety modifier based solely on OSHA total recordable injuries, and it was constructed in a way that could have 
potentially disincentivized reporting injuries. 

The stated purpose of the LPBC, which was in effect at the time of the November 2014 incident, was “to 
provide the opportunity for eligible employees to share in business results that exceed expectations.” This 
program created incentive compensation opportunities for DuPont La Porte employees in various categories, 
including operators, mechanics, and general helpers, who were represented by the International Chemical 
Workers Union Council of the United Food and Commercial Workers (ICWUC/UFCW) Local 900C labor 
union. 

The structure of the LPBC program for this group of employees evolved over the established range of 
performance years but involved two primary components. The first part, referred to as the Business Metric, 


a 42 U.S.C. § 7412(6XQ(i) . 

b Under OSHA’s Recording and Reporting Occupational Injuries and Illnesses regulations, an employer “must establish a reasonable 
procedure for employees to report work-related injuries and illnesses promptly and accurately. A procedure is not reasonable if it would 
deter or discourage a reasonable employee from accurately reporting a workplace injury or illness” ( 29 C.F.R. § 1904.35(b)(T)(iV) . The 
OSH Act and OSHA regulations, including its Recording and Reporting Occupational Injuries and Illnesses regulations, prohibit 
employers from discriminating, retaliating, or instituting other adverse consequences on employees who report injuries or other safety 
concerns. According to OSHA . “OSHA’s Whistleblower Protection Program enforces the whistleblower provisions of more than twenty 
whistleblower statutes protecting employees who report violations of various workplace safety and health, airline, commercial motor 
carrier, consumer product, environmental, financial reform, food safety, health insurance reform, motor vehicle safety, nuclear, pipeline, 
public transportation agency, railroad, maritime, and securities laws. Rights afforded by these whistleblower protection laws include, but 
are not limited to, worker participation in safety and health activities, reporting a work-related injury, illness or fatality, or reporting a 
violation of the statutes herein” [166] ( 29 C.F.R. § 1904.35(b)(T)(ivV ). 
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rewarded success with respect to site financial goals, such as increases in after-tax operating income and 
improvement in cash flow from operations. The second part, referred to as Line of Sight, represented a 
weighted average of operational performance metrics among the different units at the DuPont La Porte site, and 
consisted of things like reducing costs and exceeding production targets. 

Any incentive eligible to be paid for exceeding business performance goals, however, would then potentially be 
reduced by what the LPBC termed a “safety modifier.” For example, in performance year 2011, the DuPont La 
Porte site established the safety modifier based on the number of OSHA total recordable injuries, with the 
number of recordable injuries causing a reduction in available incentive award payments that were otherwise 
due to be paid to members of that portion of the workforce. Specifically, at the program’s start in 2011, if there 
were three or fewer recordable injuries, the LPBC set the safety modifier value at 1, which did not reduce the 
incentive payable for business performance; however, as more recordable injuries occurred, the safety modifier 
incrementally reduced the total incentive paid to employees. a 

Over the years, the LPBC evolved in terms of how the safety modifier worked. In 2014, the year of this 
incident, the LPBC adjusted the safety modifier so that every reported worker injury would decrease the group’s 
bonus payout by 5 percent, with a maximum 50 percent reduction of any available bonus paid to employees. 

By using a safety modifier that considered only worker injuries, DuPont La Porte equated safety performance 
with occupational safety metrics, similar to DuPont’s Safety Perception Surveys. Thus, DuPont La Porte did not 
include a process safety performance metric in its incentive. A disproportionate emphasis on occupational 
safety metrics as the measurement for safety performance could confuse personnel into viewing occupational 
safety and process safety as the same or perceiving that occupational safety is more important than process 
safety. Furthermore, emphasizing a low number of total recordable injuries could give personnel false 
confidence about process safety performance. 


As stated recently by CCPS in its publication on process safety culture, Essential Practices for 
Creating, Strengthening, and Sustaining Process Safety Culture , 

“Money is one of the strongest influences on human behavior, for better or worse. When developing 
compensation and incentive schemes based on process safety performance, it is critical to design them 
carefully to reinforce the desired cultural attributes and behaviors. It is equally critical to be aware of 
the many pitfalls that lead a well-intentioned compensation scheme to unwittingly support negative 
behaviors [56, p. 109].” 


a In 2011, if there were four recordable injuries, then the modifier reset to 0.9, if there were five recordable injuries it reset to 0.8, and for 
six or more recordable injuries it reset to 0.75. Over subsequent years, the safety modifier became more impactful in a negative way if the 
site had not improved its total recordable injury rate from the previous year. 
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If a company decides to use an incentive to focus on safety performance, it should consider having a process 
safety component that uses leading indicators over multiple years. Because process safety incidents are 
typically infrequent, personnel can perform poorly in process safety for a long time without experiencing a 
major accident [56, p. 110]. Therefore, using lagging indicators, such as the number of process safety incidents, 
could hide poor process safety performance [56, p. 110]. On the other hand, using leading indicators related to 
correct behaviors, such as percentage of inspection completion, is better because the events on which such 
indicators are based happen more frequently [56, p. 110]. Additionally, companies can drive long-term process 
safety performance by using multiyear incentives because process safety needs to be performed consistently 
well over time [56, p. 110]. If companies employ yearly schemes, management should ensure that rewards are 
provided in recognition of steady process safety performance over the course of a year [56, pp. 110-111]. If a 
process safety incentive is used, companies should ensure that process safety incentives are measuring key 
aspects of process safety management systems or process safety culture, and not personal or occupational safety 
metrics [56, p. 112]. Furthermore, to prevent confusion between process safety and occupational safety, 
management should not combine process safety indicators and occupational safety indicators into a single safety 
incentive [56, p. 112]. 

Regardless of its precise formulation and despite small changes made to the safety modifier throughout the 
range of years represented in this program, DuPont La Porte’s LPBC potentially created a disincentive for 
workers to report injuries. Employees working under these types of programs would report injuries at financial 
risk to themselves and their co-workers. In addition, safety incentive programs like this one may not be 
effective in driving safety improvement [74]. Furthermore, when constructed in this manner, a safety incentive 
program can be susceptible to “gaming,” with workers refraining from reporting workplace injuries to earn the 
otherwise available incentive due to be paid [74]. a This phenomenon can make it difficult to spot trends in 
worker safety issues, leaving other workers vulnerable to the same injury as potentially dangerous conditions go 
uncorrected, among other practical concerns. As OSHA Deputy Assistant Secretary Fairfax explained in a 
March 12, 2012, memorandum to agency regional administrators and whistleblower program managers, 

If employees do not feel free to report injuries or illnesses, the employer’s entire workforce is 
put at risk. Employers do not learn of and correct dangerous conditions that have resulted in 
injuries, and injured employees may not receive the proper medical attention, or the workers’ 
compensation benefits to which they are entitled. Ensuring that employees can report injuries 
or illnesses without fear of retaliation is therefore crucial to protecting worker safety and health 
[75]. 

The memorandum further expressed concern that these types of safety incentive bonus programs may place 
implicit pressure on employees not to report workplace injuries or illnesses: 


a In a recent National Safety Council article, one corporate safety manager noted that these types of incentive programs have surface 
allure but do not usually drive actual safety improvement, and suggested that some incentive programs may instead actually promote 
“covering up” and “cooking the books” through underreporting or nonreporting of workplace illnesses or injuries so employees can 
remain eligible for rewards [74]. 
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Some employers establish programs that unintentionally or intentionally provide employees an 
incentive to not report injuries. For example, an employer might enter all employees who have 
not been injured in the previous year in a drawing to win a prize, or a team of employees might 
be awarded a bonus if no one from the team is injured over some period of time. Such 
programs might be well-intentioned efforts by employers to encourage their workers to use safe 
practices. However, there are better ways to encourage safe work practices, such as incentives 
that promote worker participation in safety-related activities, such as identifying hazards or 
participating in investigations of injuries, incidents or “near misses.” OSHA’s [Voluntary 
Protection Programs] Guidance materials refer to a number of positive incentives, including 
providing tee shirts to workers serving on safety and health committees; offering modest 
rewards for suggesting ways to strengthen safety and health; or throwing a recognition party at 
the successful completion of company-wide safety and health training [75]. 

After the November 2014 incident, the DuPont La Porte site changed its LPBC bonus system to align it with 
OSHA guidance that existed at the time, such that the safety modifier would not discourage workers from 
reporting injuries. The new 2015 La Porte safety modifier was based on employees’ completing computer- 
based training courses and annual medical examinations. The CSB viewed DuPont La Porte’s correction of the 
potential disincentive in the LPBC as a positive development. 

The CSB lacks documentation showing that workers on DuPont La Porte’s Safety Committee or those covered 
by the LPBC objected to this safety modifier prior to the incident. None of the workers on the Safety 
Committee participated in the capacity of official union representative of ICWUC/UFCW Local 900C. 

However, when workers have concerns about an incentive program that can impact the reporting of incidents, 
they should report these concerns to their union, if they are represented, or to a health and safety committee or a 
manager. It is imperative, regardless of having a particular incentive program, that workers report unsafe 
conditions and safety (personal or process) incidents to help prevent future incidents. 

Consistent with OSHA regulations and guidance, all legacy DuPont sites should evaluate any safety incentive 
programs or variable pay initiatives that reduce employee bonus awards based solely upon injury rates, or that 
otherwise potentially impair OSHA record-keeping requirements, and change the payout structure to incentivize 
improved safety performance. OSHA itself does not consider “conditioning a benefit on compliance with 
legitimate safety rules or participation in safety-related activities” to violate section 1904.35(b)(l)(iv), so long as 
programs that do so are instituted appropriately.* As DuPont reviews incentive programs at its legacy sites, the 
CSB similarly encourages DuPont to continue to explore ways to encourage positive safety performance, with 
respect to both personal and process safety. Specifically, the CSB encourages DuPont to consider expanding 


a “For example, raffling off a $500 gift card each month in which employees universally complied with legitimate workplace safety 
rules—such as using required hard hats and fall protection and following lockout-tagout procedures—would not violate the rule. 
Likewise, rewarding employees for participating in safety training or identifying unsafe working conditions would not violate the rule. 
On the contrary, OSHA encourages employers to find creative ways to incentivize safe work practices and accident-prevention measures 
that do not disproportionately penalize workers who report work-related injuries or illnesses” [158]. 
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consideration of safety incentive programs by broadening the company’s focus beyond personal safety 
programs. If DuPont desires to retain safety incentive programs, the company should also consider how it can 
incentivize safety more holistically, ensuring that process safety and major accident prevention efforts are 
bolstered a along with more traditional efforts aimed at reducing workplace illnesses and injuries. In no case, 
however, should any incentive program act in any way to discourage the required reporting of safety issues such 
as injuries, illnesses, incidents, hazards, or near-miss incidents. 

Guidance to Industry 

Understanding how incidents occur can be beneficial in preventing future worker injuries and strengthening 
process safety management systems. Some safety incentive programs, however, may create a culture of 
nonreporting of safety incidents, potentially hampering learning from the underlying events, possibly resulting 
in a failure to address the causes of the incident. In response to these types of concerns, OSHA created record¬ 
keeping requirements and issued regulations to prevent whistleblower retaliation for reporting injuries. 15 ’ c 
Additionally, OSHA recently published guidance on how to formulate an incentive without disincentivizing 
workers from reporting injuries. 

On October 11, 2018, Kim Stille, Acting Director of Enforcement Programs at OSHA, issued a memorandum to 
Regional Administrators titled “Clarification of OSHA’s Position on Workplace Safety Incentive Programs and 
Post-Incident Drug Testing Under 29 C.F.R. § 1904.35(b)(l)(iv)” [76]. In that memorandum, Acting Director 
Stille sought to clarify OSHA enforcement around workplace safety incentives paid by employers. She stated 
that “29 C.F.R. § 1904.35(b)(l)(iv) does not prohibit workplace safety incentive programs” as long as such 
programs “are not implemented in a manner that discourages reporting” of workplace injuries [76]. The 
memorandum then elaborated on how an employer could avoid even “inadvertent deterrent effects of a rate- 


a According Andrew Hopkins, “Other things like incentives need to be rethought. Performance agreements and bonuses now reinforce 
the priorities of speed and production. They’ve been made to reinforce personal safety in recent years. They need now to be rethought 
again to incentivize the avoidance of catastrophe” [67, p. 3]. 

b According to the 2012 Fairfax memorandum, “Incentive programs that discourage employees from reporting their injuries are 
problematic because, under section 11(c), an employer may not ‘in any manner discriminate’ against an employee because the employee 
exercises a protected right, such as the right to report an injury.... If an employee of a firm with a safety incentive program reports an 
injury, the employee, or the employee’s entire work group, will be disqualified from receiving the incentive, which could be considered 
unlawful discrimination. One important factor to consider is whether the incentive involved is of sufficient magnitude that failure to 
receive it ‘might have dissuaded reasonable workers from’ reporting injuries. Burlington Northern & Santa Fe Railway Co. v. White , 

548 U.S. 53, 68 (2006).” The memorandum continues, “In addition, if the incentive is great enough that its loss dissuades reasonable 
workers from reporting injuries, the program would result in the employer’s failure to record injuries that it is required to record under 
Part 1904. In this case, the employer is violating that rule, and a referral for a recordkeeping investigation should be made.... This may 
be more likely in cases where an entire workgroup is disqualified because of a reported injury to one member, because the injured worker 
in such a case may feel reluctant to disadvantage the other workgroup members” [75]. 

c In explaining OSHA’s amended regulation found at 29 C.F.R. § 1904.35(b)(l)(i), OSHA Deputy Assistant Secretary Dorothy 
Dougherty made explicit the longstanding requirement for employers to have a reasonable procedure for employees to report work- 
related injuries and illnesses, and (b)(l)(iv) incorporated the existing prohibition on retaliating against employees for reporting work- 
related injuries or illnesses under section 11(c) of the OSH Act, 29 U.S.C. § 660(c). She also made clear, however, that “Section 
1904.35(b)(l)(iv) does not prohibit safety incentive programs. Rather, it prohibits taking adverse action against employees simply 
because they report work-related injuries or illness. Withholding a benefit—such as a cash prize drawing or other substantial award— 
simply because of a reported injury or illness would likely violate section 1904.3 5(b)(l)(iv) regardless of whether such an adverse action 
is taken pursuant to an incentive program [158].” 
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based incentive program by taking positive steps to create a workplace culture that emphasizes safety, and not 
just rates” [76]. For example, Acting Director Stille noted that any inadvertent deterrent effect caused by a rate- 
based incentive program could be “counterbalanced” by affirmative steps such as 

• creating an incentive program that rewards employees for identifying unsafe conditions in the 
workplace; 

• implementing a training program for all employees to reinforce reporting rights and responsibilities, 
emphasizing the employer’s nonretaliation policy; or 

• instituting a mechanism for accurately evaluating employees’ willingness to report injuries and illnesses 

^ 6 ] 

In Essential Practices for Creating, Strengthening, and Sustaining Process Safety Culture , CCPS posed the 
question of whether a company should forgo all process safety-related incentives. CCPS stated that an 
argument can be made to that effect, with working injury-free serving as a long-term benefit for any worker. 
Nevertheless, money is a strong human motivator, and if used with care, it can influence behavior for the better 
[56, p. 109]. As with occupational safety-based incentives, management should consider whether the use of a 
process safety incentive creates a potential for inverse effects. An incentive could lead to the opposite of the 
desired behavior (e.g., using incident numbers or incident reduction for the basis of an incentive “may drive 
personnel to hide or under-report incidents”) [56, p. 110]. 

Companies should assess safety incentive programs currently in place to ensure they are effective in driving 
positive safety change and do not serve as a disincentive for reporting workplace safety issues. 

8 Key Findings 

In its investigation of the November 15, 2014, DuPont La Porte incident, the CSB found that 

1. DuPont did not effectively respond to a toxic chemical release; 

2. DuPont’s corporate process safety management system did not ensure that DuPont La Porte 
implemented and maintained an effective process safety management system; and 

3. DuPont La Porte did not assess its culture for process safety in the site’s Safety Perception Surveys or 
any other formal assessment program, allowing serious process safety deficiencies to exist at the site. 

The CSB issues recommendations to the DuPont La Porte facility, DuPont, and the Local 900C of the 
International Chemical Workers Union Council of the United Food and Commercial Workers, as well as 
guidance and key lessons for the chemical industry, to address these key findings and to help prevent future 
incidents. 
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9 Safety Guidance 

The CSB, through the course of its investigation, identified key lessons from the November 15, 2014 incident 
that companies can use at their facilities (for more information, see Guidance to Industry from referenced 
sections). 

1. Companies should ensure that employees understand the hazards of chemicals that they are working 
with and may be potentially exposed to if there is a release. Where there are multiple hazardous 
chemicals, such as methyl isocyanate (MIC) and methyl mercaptan, it is important that companies 
effectively train workers on the hazards of each chemical at their facility. Furthermore, companies 
should train workers who handle multiple highly toxic chemicals, such as methyl mercaptan and MIC, 
to treat these chemicals with equal importance. This training is important for workers to help ensure 
they have a working knowledge of the relevant chemical hazards. (Section 3: Delayed Awareness of 
Toxic Chemical Release) 

2. Automatic alarms designed to alert personnel of hazardous conditions—such as a release of a toxic 
chemical or the existence of an explosive atmosphere—can relay critical safety information immediately 
to personnel, without the potential delays inherent in a system that relies solely on a control room 
operator to communicate safety alarms verbally to operators in the field. (Section 3: Delayed 
Awareness of Toxic Chemical Release) 

3. Specific technical knowledge from unit experts—including technical and operations personnel—can be 
invaluable to the incident commander in an emergency at a chemical processing facility. Companies 
need to ensure that these individuals are preidentified as technical support personnel and that backup 
capability is available in the event the primary technical support personnel become unavailable. 

(Section 4.2: Process Coordinator Was Missing) 

4. Plant emergency procedures should clearly outline the alerting and notification protocols for different 
types of plant emergencies. These procedures should also include guidance for situations in which there 
is insufficient initial information to effectively assess the nature of the problem and the level of 
emergency response team resources required. (Section 4.3.1: Call for ERT Response) 

5. Even though industrial facilities may infrequently call upon emergency response vehicles, it is essential 
that those vehicles function as intended when needed. To ensure emergency vehicle reliability, 
companies must develop and apply regular maintenance and testing schedules for their emergency 
response vehicles. (Section 4.3.2: ERT Mini-Pumper Truck Not Operational) 

6. Companies need a reliable means for emergency response teams to characterize hazardous atmospheres. 
Companies should provide air monitoring equipment to emergency response teams and train those 
teams on how to operate the equipment and interpret monitoring results. At facilities that assign the 
inspection, maintenance, and storage of portable air monitoring equipment to personnel who are not 
members of the emergency response team, the company should ensure that team members know where 
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the equipment is stored and can access it. (Section 4.4.1: Entry into Potentially Explosive 
Atmosphere) 

7. High-hazard areas should be equipped with adequate detectors, alarms, and surveillance technology to 
identify whether there is a chemical release (or other type of emergency) and if personnel are affected. 

(Section 4.4.2: No Technology to Locate Missing Workers) 

8. Companies need to develop a system to update emergency planning documents when pertinent hazards 
are identified. Changes to emergency planning documents should be effectively communicated to the 
site emergency response team. (Section 4.4.3: Unrecognized Manufacturing Building Collapse 
Hazard) 

9. Chemical facilities should ensure that their emergency response plans include maps showing the layout 
of buildings containing hazardous chemicals, for use by emergency responders and to aid evacuation 
and rescue efforts. Facilities should also coordinate regularly scheduled site tours for both plant and 
external emergency responders to develop strong working relationships and help ensure responders are 
familiar with facility access points, hazards, emergency response issues, and site or facility layout. 
Additionally, facilities should familiarize responders with process structures or buildings by having 
periodic drills inside them, to improve responder navigation during emergencies. To enhance responder 
performance, members of an emergency response team should train together, especially when multiple 
companies are staffing a single, integrated team. (Section 4.5: Difficulties Navigating Manufacturing 
Building) 

10. When a process safety incident occurs, such as a chemical release, it can be beneficial for technical 
personnel who are not immediately involved in emergency response functions to analyze process data to 
assess the source, scope, and magnitude of the incident. This analysis can help the company (and the 
incident commander) identify needed equipment manipulations to stop or control the incident, such as 
shutting down pumps or closing isolation valves. (Section 4.6: No Analysis of Process Data to 
Identify Source of Leak) 

11. Companies should ensure emergency response team members are trained to (1) physically designate the 
hot zone; (2) communicate the location of the hot zone and entry control points to all personnel assisting 
with the emergency response, including operations personnel; and (3) control entry and exit points of 
the hot zone. (Section 4.7: Inadequate Creation and Control of Hot Zone) 

12. Dispersion modeling of chemical releases can be an effective risk-based emergency response tool, but 
its results are highly dependent on accurate input data. During an emergency, it can sometimes be 
difficult to obtain an accurate release rate, limiting the accuracy of resulting models. Companies should 
not rely on unsupported data when making critical emergency response decisions, such as those 
affecting workers, members of the public, or people or property in the surrounding area. In emergencies 
that could affect the public and in which chemical release rates cannot be accurately estimated (for 
model input), written guidelines for how and when to alert the public should be available to emergency 
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responders. As better information about the release becomes available, the public protection zone can 
be adjusted accordingly. (Section 4.8.1: Release Modeling) 

13. Monitoring for hazardous gases along the fence line at chemical facilities can help companies 
understand the extent of a release. This monitoring can be performed by fixed detectors, which can 
continually collect and record data, providing early notification of releases outside the property. When 
fixed detectors are not available, a person using a portable gas detector may also perform air monitoring. 
This strategy, however, introduces additional risk because that individual may enter a hazardous 
environment unknowingly. Proper personal protective equipment, including respiratory protection, is 
needed during manual air monitoring operations. (Section 4.8.4: Air Monitoring) 

14. Employing any particular management system on its own, without additional work aimed at successful 
implementation, may not be sufficient to prevent major chemical incidents. Companies should conduct 
periodic comprehensive assessments of their process safety management systems and their 
implementation of these systems at established intervals to evaluate and identify opportunities to 
strengthen their systems’ effectiveness. (Section 5.3: American Chemistry Council) 

15. Companies should ensure that when a process safety management system changes, their sites update 
their programs simultaneously and adhere to those changes. The ability to adapt quickly to industry 
trends and field learnings can be beneficial. To maximize the value of improvements, companies should 
consider reevaluating sites to ensure consistency with evolving practices. (Section 5.3.3: Responsible 
Care Conformance Audits) 

16. Companies should invest time and resources to conduct audits. These resources should be used to 
ensure that audits are robust and comprehensive. (Section 5.3.3: Responsible Care Conformance 
Audits) 

17. Personal safety performance and process safety performance are two different safety measures that all 
chemical process facilities should evaluate. Personal injury statistics are not an effective gauge of the 
quality of process safety management systems or process safety culture. (Section 5.4.1: Building a 
Safety Culture) 

18. Companies should have a process in place to ensure that hazard scenarios are fully developed and that 
process hazard analysis (PHA) teams assign appropriate initiating event frequencies and consequence 
severities to the scenario because it can make a significant difference in safeguard requirements. 
Additionally, PHA teams need to ensure that the safeguards applied to the hazard scenario are relevant 
and effective in controlling the hazard. (Section 6.1:Process Hazard Analysis Evaluation) 

19. Companies should ensure before corrective actions are closed that the intent of a recommendation is 
met. One way to make the intention of the recommendation the focus of a corporate or site action is to 
evaluate the substance of the corrective action in addition to the time it takes to complete the action. 

(Section 6.2: Implementation of Corrective Actions) 
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20. Companies should develop an action plan to identify and control hazards during troubleshooting 
operations. There are multiple approaches a company can take to address troubleshooting, including 
PHAs, operating procedures, management of change (MOC) procedures, and safe work practices. 

(Section 6.3: Process Safety Practices during Troubleshooting Operations) 

21. Companies should always use MOCs where required by corporate policy or federal safety regulations 
(OSHA’s Process Safety Management standard or the EPA’s Risk Management Plan rule). Special 
attention should be paid to nonroutine or abnormal operations because there may be issues with safety 
systems, equipment, procedures, or personnel practices that can create additional hazards, potentially 
leading to serious safety incidents if there are poor management of change practices. MOC reviewers 
should be thoughtful and comprehensive, so potential dangers can be avoided or mitigated. (Section 
6.4: MOC Practices) 

22. Companies should recognize that nonroutine operations such as line breaking—even with established 
permit processes—can represent significant potential dangers. One way to help ensure that personnel 
understand the permit process is to train them on the different scenarios that would trigger a line- 
breaking permit. Companies should analyze recurring operational or safety issues that trigger permits 
and eliminate their underlying causes. In instances requiring repeated line breaking, for example, a 
hazard analysis should be performed, and an engineering solution should be applied (following an 
effective MOC) to avoid recurrence of the hazard. (Section 6.5: Line-Breaking Practices) 

23. Effective communication between different operational units at a facility, and between supervisors and 
workers on changing shifts, is critical to safety. Communications are essential to convey the status of 
operations, any ongoing changes, abnormalities, unusual operating conditions, or other relevant issues 
associated with chemical process equipment. The more complex the process involved, the more of an 
imperative exists to ensure that communication is effective. Reliance solely upon one form of 
communication, especially verbal communication, can leave the workforce vulnerable to potential gaps 
in information communicated, misunderstandings, or the absence of critical information in what 
oftentimes can be an evolving situation. (Section 6.6: Shift Communication Practices) 

24. Employee incentive programs that reduce bonuses to employees based upon the number of recordable 
injuries—or other similar metric—can create a disincentive for workers to report injuries or incidents. 
Understanding how incidents occur can be beneficial in preventing future worker injuries and 
strengthening process safety management systems. Some safety incentive programs, however, may 
create a culture of nonreporting of safety incidents, potentially hampering learning from the underlying 
events, possibly resulting in a failure to address the causes of the incident. If employees do not feel free 
to report workplace injuries, incidents, or near misses, the employer’s entire workforce is put at risk. 
Ensuring that employees can report injuries or other process safety management system deficiencies is 
therefore central to protecting worker safety and health and aiding accident prevention. (Section 7.1: 
Employee Incentive Program) 
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10 Recommendations 

The CSB makes the following safety recommendations: 

10.1 DuPont La Porte, Texas, Chemical Facility 

2015-01-I-TX-R8 

Work together with emergency response team (ERT) member companies (DuPont, Chemours, Kuraray, and 
Invista), the International Chemical Workers Union Council of the United Food and Commercial Workers 
(ICWUC/UFCW) Focal 900C, and the ICWUC/UFCW staff (if requested by the Focal 900C) to update the 
DuPont Fa Porte emergency response plan. The emergency response program should ensure that periodic 
exercises or drills are performed on new procedures developed to address key lessons to strengthen ERT 
capabilities. The emergency response program should address the following: 

• Preidentifying unit experts as technical support personnel and ensuring that backup capability is 
available in the event the primary technical support personnel become unavailable. (Section 4.2: 
Process Coordinator Was Missing) 

• Clearly detailing in plant emergency procedures the alerting and notification protocols for different 
types of plant emergencies. Provide initial training to new plant personnel and periodic training to all 
plant personnel on these emergency communication procedures. These procedures should also include 
guidance for emergency responders when there is insufficient initial information to effectively assess 
the nature of the problem and the level of ERT resources required. (Section 4.3.1: Call for ERT 
Response) 

• Developing and applying regular maintenance schedules for emergency response vehicles consistent 
with the National Fire Protection Association’s Standard for the Inspection, Maintenance, Testing, and 
Retirement of In-Service Emergency Vehicles (NFPA 1911), which requires weekly visual and 
operational checks of emergency vehicles and has example checklists to use when performing 
preventive maintenance on emergency vehicles. (Section 4.3.2: ERT Mini-Pumper Truck Not 
Operational) 

• Ensuring that ERTs have reliable means to characterize hazardous atmospheres, for example equipment 
that monitors toxicity, explosivity, and oxygen levels. Additionally, ensure that ERT members know 
where the equipment is stored, can access it, and are trained on its proper use. (Section 4.4.1: Entry 
into Potentially Explosive Atmosphere) 

• Evaluating high-hazard areas, including PSM covered processes, to determine whether detectors and 
alarms are necessary to identify chemical releases (or other types of emergencies). Additionally, 
consider equipping high-hazard areas with surveillance technology to identify personnel in the field. 

(Section 4.4.2: No Technology to Locate Missing Workers) 
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• Developing and implementing written policy and procedures to update emergency response plan 
documents when hazards are identified. For example, personnel can identify these types of hazards in 
process hazard analyses, facility siting studies, management of change reviews, and incident 
investigations. Changes to emergency planning documents should be effectively communicated to the 
site ERT as soon as possible after identifying the hazard. (Section 4.4.3: Unrecognized 
Manufacturing Building Collapse Hazard) 

• Ensuring that emergency response planning accounts for difficulties in conducting response efforts, 
including (1) maps included in emergency response plans to show the layout of buildings containing 
hazardous chemicals, for use by emergency responders and to aid evacuation and rescue efforts; (2) 
coordination of periodic (at least annual) site tours for plant and external emergency responders; (3) 
training emergency responders to help ensure familiarity with facility access points, hazards, emergency 
response issues, and site or facility layout; and (4) building teamwork by having members (from the 
different companies) of the ERT field train (by conducting drills) together when practicable. (Section 
4.5: Difficulties Navigating Manufacturing Building) 

• Assigning knowledgeable personnel the responsibility to analyze process data to assess the source, 
scope, and magnitude of any incident. (Section 4.6: No Analysis of Process Data to Identify Source 
of Leak) 

• Training emergency response team members to (1) physically designate the hot zone; (2) communicate 
the location of the hot zone and entry control points to all personnel assisting with the emergency 
response, including operations personnel; and (3) control entry and exit points of the hot zone. (Section 
4.7: Inadequate Control of Hot Zone) 

• Addressing in the emergency response plan how to characterize (including size, concentration, location, 
and direction of release) hazardous chemical releases and providing guidance on how and where people 
should take protective action (e.g., sheltering-in-place) in the event of a chemical release. (Section 
4.8.1: Release Modeling) 

• Developing a procedure in the emergency response plan to effectively monitor for hazardous gases 
along the fence line at chemical facilities during the release to help workers understand and clearly 
communicate the extent of a release. (Section 4.8.4: Air Monitoring) 

In addition, provide a copy of the emergency response plan to the Emergency Response Team and their local 
union representatives. 
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10.2 Local 900C of the International Chemical Workers Union Council (ICWUC) 
of the United Food and Commercial Workers (UFCW) a 

2015-01-I-TX-R9 

Work together with DuPont to develop and implement the emergency response plan described in 
Recommendation R8 (2015-01-I-TX-R8). 


a The union members at the DuPont La Porte facility were represented by the ( ICWUC ) of the (UFCW) and Local 900C. 
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Appendix A: Causal Analysis 


The AcciMap a (size 11” x 17”) can be found at www.csb.gov on the DuPont La Porte investigation page. 


a An AcciMap is a multilayered causal diagram that arranges the various causes of an accident in terms of their remoteness from the 
initiating events. This approach differs from other analysis techniques in that it identifies causes in all parts of the system, ranging from 
the physical sequence of events right up to causes at the governmental, regulatory, and societal levels. It is a CSB internal investigation 
procedure that is especially useful for developing broadly applicable recommendations for prevention. 
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Appendix B: IncidentTimeline 


Approximate Time 

Activity 

Wednesday, 

November 12, 2014 


2:00-3:00 pm 

Operators attempt to restart the Lannate® process after a unit shutdown, but flow is 
not established because equipment is plugged. 

3:00 pm 

Operators begin troubleshooting the Lannate® process to try to clear the plugging. 

Friday, November 

14,2014 


10:00 am-3:02 am 

Methyl mercaptan is released outside and inside the manufacturing building while 
troubleshooting to clear the plugging continues. Detectors inside and outside the 
manufacturing building identify high levels of methyl mercaptan and trigger alarms 

32 separate times. These alarms display only on the control panel (there are no 
building or exterior alarms). Operations personnel who are aware of the alarms and 
the troubleshooting do not perceive the leaks as posing a serious hazard (see 
Investigation Note below). 

Investigation Note 

Operations personnel likely normalized both the methyl mercaptan odor and the 
detector alarms. Personnel associated these methyl mercaptan leaks with the ongoing 
troubleshooting activities. 

Saturday, November 
15, 2014 (Day of 
Incident) 


2:51 am-2:54 am 

High pressure in equipment inside the manufacturing building triggers control system 
alarms. Operations personnel attribute the high pressure to a common long-standing 
problem with process condensate accumulating in the waste gas vent header piping. 
Unknown to the operations personnel, in this instance the high pressure is not caused 
by the typical process condensate accumulation. The high pressure is a symptom of a 
different problem: liquid methyl mercaptan flowing into the waste gas vent header 
piping, due to the piping alignment being used to clear the plugging during the 
troubleshooting efforts. 

2:58 am-3:03 am 

Shift Supervisor and Operator 1 separately go to the third floor of the manufacturing 
building to try to reduce the equipment pressure. They plan to drain the equipment of 
what they believe is normal process condensate to reduce the high pressure—a long¬ 
standing practice used to reduce pressure in this equipment. 

3:01 am-3:13 am 

Two drain valves on the waste gas vent header are manually opened on the third floor 
of the manufacturing building. Highly toxic and highly flammable liquid methyl 
mercaptan flows out of the valves, overcoming the Shift Supervisor. 
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3:13 am 

The second-floor chlorine detector records a value of -1. This type of detector is 
known to go negative when sensing methyl mercaptan (-1 parts per million chlorine 
indication ~ 33 parts per million methyl mercaptan). 

3:24 am-3:26 am 

Three methyl mercaptan detectors inside the manufacturing building (two on the first 
floor and one on the fourth floor) sense at least 25 parts per million methyl mercaptan, 
triggering alarms at the control panel. The Board Operator may see these alarms but 
does not realize a chemical release has begun, likely associating the alarms with 
process troubleshooting. His focus is on mitigating the equipment high-pressure 

event. 

3:30 am 

Operator 1, who is likely on third floor of manufacturing building, makes an urgent 
distress call over the radio for help. Personnel do not know where Operator 1 is 
located or the type of emergency she is experiencing. Some DuPont La Porte 
personnel who hear her distress call interpret the communication to mean that 

Operator 1 has a personal injury—such as a broken leg. Personnel in the control room 
do not yet realize there is a toxic chemical release. 

3:30 am 

Control room operator tries to get more information through radio communication, 
but neither the Shift Supervisor nor Operator 1 responds. 

3:30 am - 3:40 am 

An operator (Operator 5) on the first floor of the manufacturing building is exposed to 
methyl mercaptan and experiences dizziness and blurry vision. He escapes from the 
manufacturing building, runs across the street, and lies down in the grass, where he 

starts to recover. 

3:30 am 

Two operators (Operator 2 and Operator 3) in the control room run into the 
manufacturing building to respond to the distress call made by Operator 1. They do 
not realize they are responding to a serious toxic methyl mercaptan leak. They do not 
wear or take with them any respiratory protection. 

3:30 am 

Operator 4, who is outside, sees Operator 2 and Operator 3 running into the 
manufacturing building and follows them. He also does not realize they are 
responding to a serious toxic methyl mercaptan leak. He does not wear or take with 
him any respiratory protection. 

Investigation Note 

No visual or audible alarms are installed inside the manufacturing building to warn 
operators in the field of the hazardous concentration of methyl mercaptan inside the 
manufacturing building. Operations personnel entering the manufacturing building 
responding to Operator 1 ’s distress call have no indication of a lethal methyl 
mercaptan concentration in the manufacturing building. 

3:30-3:35 am 

Operator 2 enters the south stairway and likely goes directly to the third floor, where 
he is incapacitated by methyl mercaptan. 

3:30-3:35 am 

Operator 3 goes up the stairs to the fourth floor but does not find anyone. 

3:30-3:35 am 

Operator 4 goes up the stairs to the second floor. He walks about 10 feet and hits a 
“wall” of methyl mercaptan. He manages to retreat to the stairwell. 
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3:35 am 

Operator 3 announces on the unit’s public-address system that he does not see anyone 
on the fourth floor. The control operator responds that the Shift Supervisor and 
Operator 1 may be on the third floor. Operator 3 begins to feel light-headed. He 
makes his way to the staircase and loses consciousness while descending the stairs 
from the fourth floor. 

3:35 am 

The Board Operator attempts to reach the Shift Supervisor, Operator 1, and Operator 

2 over the radio, but they do not respond. Personnel in the control room begin to 
realize something is wrong. Operator 6—the brother of Operator 2—grabs three 5- 
minute escape respirators. Other operators in the control room tell him not to enter 
the manufacturing building because they do not yet know what is going on or where 
the nonresponsive operators are. Operator 6, however, takes the escape respirators 
and heads into the manufacturing building. 

3:40 am 

Operator 6 encounters Operator 4 in the stairway and puts an escape respirator on 
him. The breathing air helps Operator 4 recover, and he exits the manufacturing 
building safely. 

3:40 am 

Operator 5 attempts to communicate by radio to inform co-workers of his exposure to 
a chemical release in the manufacturing building. (It is unclear if others hear him.) 

3:40 am 

The manufacturing building fume release alarm sounds. It is a manually activated 
alarm intended to alert area workers of a toxic chemical release in the building. 

Operator 6 likely activated it. 

3:50 am 

The Board Operator calls for the plant emergency response team (ERT) to respond, 
communicating that workers are missing. ERT members believe they are called to 
perform a rescue (e.g., broken bone) and do not know there is a toxic chemical 
release. 

3:57 am 

The Board Operator calls the security guard at the main entrance and asks the guard to 
call 9-1-1. There is still confusion about what is going on, and the Board Operator 
communicates that workers are missing and requests rescue. The guard gives limited 
information to the 9-1-1 operator. 

3:58 am 

Site emergency responders from the ERT arrive at the scene, but they do not have 
proper personal protective equipment (PPE) to enter a building with an active 
hazardous chemical release (methyl mercaptan is both highly toxic and highly 
flammable). They have prepared and responded to perform a technical rescue and 
brought gear only for that operation (harnesses, ropes, and haul systems). When they 
arrive at the manufacturing building, they realize it is a chemical release and they 
need additional PPE. 

4:05 am 

The site Incident Commander who responded to the initial rescue request calls for the 
ERT to come to the scene with bunker gear and self-contained breathing apparatus 
(SCBA)—necessary PPE to enter an area with a toxic chemical release. 
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4:10 am 

The truck containing the ERT’s SCBAs and radios does not start and cannot come to 
the scene. An October 2, 2014 work order stated, “Check batteries and they were not 
good, remove and replace with new ones.” Replacing the battery did not fully repair 
the truck, and it still could not start at the time of the incident. After the incident, 
DuPont replaced the truck’s alternator, battery cable, and belts. DuPont did not 
adequately maintain the SCBA truck before the incident to ensure it could operate 
during an emergency. 

4:12 am 

A second 9-1-1 call is made by one of the area supervisors. 

4:18 am 

Harris County Sherriff s deputies arrive at control room. 

4:20 am 

Operator 3 regains consciousness and manages to exit the manufacturing building of 
his own volition. Fire brigade members escort him to safety. 

4:25^1:45 am 

First ERT team enters manufacturing building. While they are in the manufacturing 
building they do not monitor the concentration of methyl mercaptan, which in 
addition to being toxic, is a highly flammable chemical. CSB calculations indicate 
that at times a portion of the building had an explosive atmosphere from the release. 

A 2002 DuPont study found that a methyl mercaptan vapor cloud explosion could 
cause the manufacturing building to collapse, but the ERT did not know that. 

An ERT member finds drain valves from the waste gas vent header on the third floor 
open with a gas (later determined to be methyl mercaptan) flowing from them. The 
Shift Supervisor is found unconscious on the third floor approximately 30 feet north 
of the drain valves. Operator 6 is found next to his brother (Operator 2), both 
unconscious. Operator 2 has a 5-minute escape respirator on his head. The respirator 
is one of the three escape packs brought into the building by his brother (Operator 6). 
Operator 6 has a 30-minute SCBA air bottle in front of him and the mask on his face, 
but he has not connected the mask to the air bottle. (Operator 6 was likely 
incapacitated by methyl mercaptan while trying to don the SCBA, before he 
connected his mask to the SCBA air bottle.) It is later determined that the Shift 
Supervisor, Operator 2, and Operator 6 died from toxic exposure / asphyxiation. 

5:08 am 

First group of external fire fighters arrive on-site. 

5:09 am 

Second group of external fire fighters arrive on-site. 

5:10 am 

Third group of external fire fighters arrive on-site. 

5:15 am 

Second ERT entry conducted. DuPont and other plant ERT emergency responders do 
not monitor the methyl mercaptan concentration inside of the manufacturing building. 
On the third floor, an ERT responder closes an open drain valve from which a gas 
(methyl mercaptan) is escaping. 

6:02 am 

Methyl mercaptan storage tank pump is turned off, significantly slowing the methyl 
mercaptan release to the atmosphere. 

6:10 am-9:30 am 

Third, fourth, and fifth ERT entries are conducted to look for missing Operator 1. 
DuPont and other plant ERT emergency responders do not monitor the methyl 
mercaptan concentration inside of the manufacturing building. (When Harris County 
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emergency responders conduct building entries, beginning after about 6:40 am, they 
monitor the air inside the manufacturing building using a QRAE monitor and a 
MultiRAE monitor.) 

Emergency responders cannot find Operator 1, possibly because there could be areas 
inside the manufacturing building that they are not aware they have not searched. 

They have no maps to reference during their search, and the manufacturing building is 
not equipped with cameras to view the different floors of the building. Area 
operators—including the Board Operator—draw building maps to assist emergency 
responders in navigating the manufacturing building. 

ERT responders continue closing valves to stop the release of methyl mercaptan. 

6:14 am 

Sheriffs sergeant notices an “intense smell” in Deer Park (west of La Porte). 

6:38 am 

A sheriffs sergeant driving on Texas Highway 225 communicates that “the odor on 

225 is strong.” 

8:07 am 

Harris County performs first off-site air monitoring (near Highway 225) and does not 
detect methyl mercaptan in the air. 

10:07 am 

DuPont activates the methyl mercaptan tank emergency isolation valve to stop methyl 
mercaptan from flowing to the process. 

11:15 am-ll:55 am 

Sixth ERT entry is conducted. Operator 1 is recovered in the north stairwell of the 
manufacturing building. She is later determined to be deceased, having died from 
toxic exposure / asphyxiation. 

11:40 am 

Final waste gas vent header drain valve is closed to fully stop methyl mercaptan 
release. 
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Appendix C: Odor Complaints from November 15,2014 



DuPont Plant Emission Event 
November 15, 2014 


DuPont Plant Emission Event 
Date: November 15, 2014 
+ = Odor 
= No Odor 


Source: Harris County 


Figure 40. Map of the Odor Complaints (Yellow Pins) from the November 15, 2014 Incident. Source: Harris County, Texas. 


FINAL COPY 


Page 155 














U.S. Chemical Safety and 
Hazard Investigation Board 


Toxic Chemical Release at the 
DuPont La Porte Chemical Facility 

La Porte, Texas | Incident Date: November 15, 2014 | No. 2015-01-l-TX 


Appendix D: Emergency Response Tables 

The regulatory tables in this appendix focus on the most significant OSH A and EPA requirements regarding 
Emergency Response and Preparedness. Companies should first determine what regulations apply to their 
process or facility and whether they are statutorily required to conduct or will voluntarily conduct an emergency 
response.* Based on this information, companies should develop an integrated approach to their requirements. 

Table 1. OSHA and EPA Regulations That Apply to Emergency Response Preparedness. 


Regulation 

Name 

Requirement 

29 C.F.R. § 1910.119 

Process Safety Management of 

Highly Hazardous Chemicals (PSM) 

Requires an emergency action plan or an 
emergency response plan (if there is an 
internal emergency response team). 

29 C.F.R. § 1910.38 

Emergency Action Plans 

Dictates the minimum procedures necessary 
to alert emergency personnel of an 
emergency. 

29 C.F.R. § 1910.120 

Hazardous Waste Operations and 
Emergency Response (HAZWOPER) 

Requires an emergency response plan if there 
are hazardous materials and there is an 
internal emergency response. 

42 U.S.C. § 116 

Emergency Planning and Community 
Right-to-Know Act (EPCRA) 

Requires states to develop a state emergency 
planning commission and local emergency 
planning committees (LEPC). Requires an 
emergency response plan and emergency 
notifications. 

40 C.F.R. § 681G1 

Risk Management Plan (RMP) b 

Requires an emergency response program. 
Requirements may potentially be fulfilled by 
developing emergency response plans 
required by other agencies. 


a The term response has the same meaning under OSHA’s Hazardous Waste Operations and Emergency Response (HAZWOPER) 
standard and EPA’s Risk Management Plan rule [151, p. 2]. OSHA defines emergency response under the HAZWOPER standard as “a 
response effort by employees from outside the immediate release area or by other designated responders (i.e., mutual aid groups, local 
fire departments, etc.) to an occurrence which results, or is likely to result, in an uncontrolled release of a hazardous substance. 

Responses to incidental releases of hazardous substances where the substance can be absorbed, neutralized, or otherwise controlled at the 
time of release by employees in the immediate release area, or by maintenance personnel are not considered to be emergency responses 
within the scope of this standard. Responses to releases of hazardous substances where there is no potential safety or health hazard (i.e., 
fire, explosion, or chemical exposure) are not considered to be emergency responses” ( 29 C.F.R. § 1910.120(a)(3)) . 
b The EPA has published general guidance on Emergency Response Programs and other aspects of RMP. 
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Table 2. Requirements for an Emergency Action Plan ( 29 C.F.R. 5 1910.38 ) and Emergency Response Plan ( 29 C.F.R. 5 1910.120 ) under 
OSHA. 


Requirement 

Emergency 
Action Plan 

Emergency 
Response Plan 

Procedures for reporting a fire or other emergency 

y 


Procedures for emergency evacuation, including type of evacuation 
and exit route assignments 

V 


Procedures for employees who remain to operate critical plant 
operations before they evacuate 

y 


Procedures to account for all employees after evacuation 

y 


Procedures for employees performing rescue or medical duties 

y 


The name or job title of every employee who may be contacted by 
employees who need more information about the plan or an 
explanation of their duties under the plan 

y 


Pre-emergency planning and coordination with outside parties 


y 

Personnel roles, lines of authority, training, and communication 


y 

Emergency recognition and prevention 


y 

Safe distances and places of refuge 


y 

Site security and control 


y 

Evacuation routes and procedures 


y 

Decontamination 


y 

Emergency medical treatment and first aid 


y 

Emergency alerting and response procedures 


y 

Critique of response and follow-up 


y 

Personal protective equipment and emergency equipment 


y 
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Table 3. Emergency Response Program requirements under RMP for Responding Facilities. 


Elements 

Requirement 

Emergency response plan 

An emergency response plan maintained at the facility that includes (1) 
procedures for informing the public and emergency response agencies about 
releases, (2) documentation of proper first aid and emergency medical treatment 
necessary to treat human exposures, and (3) procedures and measures for 
emergency response 

Planning coordination 

Coordination with local response agencies on responses to potential release of 
regulated substances 

Emergency equipment 

Procedures for using, inspecting, testing, and maintaining emergency response 
equipment 

Employee training 

Training for all employees in relevant procedures 

Response plan evaluation 

Procedures for reviewing and updating the response plan to reflect changes at the 
facility and for ensuring that employees are informed of the changes 
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Table 4. Industry and Government Guidance Related to Emergency Response. 


Organization 

Name 

Description 

Federal Emergency 
Management 

Agency (FEMA) 

National Incident Management 

System (NIMS) 

A common framework for overall incident 
management. A comprehensive approach that is 
applicable at all jurisdictional levels 

American Petroleum 
Institute (API) 

RP API 1174, API Recommended 
Practice for Pipeline Emergency 
Preparedness and Response 

Enhanced framework for an emergency 
management system for onshore hazardous liquid 
pipeline operators 

National Fire 

Protection 

Association (NFPA) 

NFPA 472. Standard for 

Competence of Responders to 
Hazardous Materials/Weapons of 
Mass Destruction Incidents 

Minimum levels of competence required by 
responders to emergencies involving hazardous 
materials or weapons of mass destruction 

National Fire 

Protection 

Association (NFPA) 

NFPA 475, Recommended Practice 
for Organizing, Managing, and 
Sustaining a Hazardous 
Materials/Weapons of Mass 
Destruction Response Program 

Criteria for the organization, management, and 
deployment of personnel, resources, and 
programs for entities responsible for the 
hazardous materials/weapons of mass destruction 
emergency preparedness function 

National Fire 

Protection 

Association (NFPA) 

NFPA 600, Standard on Facility Fire 
Brigades 

Requirements for organizing, operating, training, 
and equipping industrial fire brigades 

National Fire 

Protection 

Association (NFPA) 

NFPA 704, Standard System for the 

Identification of the Hazards of 
Materials for Emergency Response 

The NFPA’s Hazard Diamond, a labeling system 
that identifies the hazards of materials 

National Fire 

Protection 

Association (NFPA) 

NFPA 1221. Standard for the 
Installation, Maintenance, and Use 
of Emergency Services 
Communications Systems 

The installation, performance, operation, and 
maintenance of communications systems and 
facilities used by public emergency services 

National Fire 

Protection 

Association (NFPA) 

NFPA 1250, Recommended Practice 
in Fire and Emergency Service 
Organization Risk Management 

Criteria to develop, implement, or evaluate a fire 
and emergency service organization risk 
management program for effective risk 
identification, control, and financing 

National Fire 

Protection 

Association (NFPA) 

NFPA 1561, Standard on Emergencv 
Services Incident Management 

System and Command Safety 

Requirements for the structure and operation of 
an incident management system for emergency 
services, including principles of command safety 
to be incorporated into all incidents, training, or 
emergencies, to ensure the safety of emergency 
responders and others on the scene of an incident 

National Fire 

Protection 

Association (NFPA) 

NFPA 1600, Standard on Continuity, 
Emergency, and Crisis Management 

Common set of criteria for all hazards, disaster, 
emergency management, and business continuity 
or continuity-of-operations programs 
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Organization 

Name 

Description 

National Fire 

Protection 

Association (NFPA) 

NFPA 1620. Standard for Pre- 
Incident Planning 

Criteria for developing pre-incident plans to help 
responders effectively manage emergencies 
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Appendix E: DuPont Safety Perception Surveys 

For more than a decade, DuPont developed and honed a safety culture program to reduce its OSHA total 
recordable injury rate by assessing and improving occupational (personal) safety, using its Bradley Curve and 
Safety Perception Survey tools. 

In the 1990s, DuPont identified a significant discrepancy in safety performance at different DuPont sites around 
the world. Some of the company’s sites had few recordable injuries, and other sites had many. To improve 
safety performance at DuPont sites, a former DuPont Chairman and CEO created a team dubbed the Discovery 
Team to find a sustainable way to strengthen safety performance at all DuPont facilities, with the ultimate goal 
of having zero incidents throughout the entire organization [77]. 

The Discovery Team found that the sites with the best worker safety records more prevalently practiced DuPont 
safety principles. The Discovery Team also asserted that sites with the most worker injuries had a lack of 
management commitment to safety, more communication breakdowns, and inconsistent safety leadership. 
Overall, the Discovery Team claimed that DuPont sites with fewer worker injuries had a distinctive safety 
culture that permeated the entire facility [77]. 

Verlon Bradley, then manager of the DuPont plant in Beaumont, Texas, along with the Discovery Team, created 
a model named the Bradley Curve (Figure 41). The Bradley Curve aimed to illustrate the strength of an 
organization’s safety culture and its relationship to the number of worker (OSHA recordable) injuries [77]. 
DuPont began using the Bradley Curve model internally, and in 1995, DuPont’s consulting service, DuPont 
Sustainable Solutions, began applying the Bradley Curve model to improve safety performance at other 
companies in various industries [78]. 
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Figure 41. The DuPont Bradley Curve. The Bradley Curve correlates improved safety culture with reduced OSHA 
recordable injury rates. For more information, see Bradley Curve . Source: DuPont. 


In 1999, DuPont formalized a method to assess an organization’s safety culture with its Safety Perception 
Survey a to measure the strength of the safety culture at each site. The Safety Perception Survey consists of 24 
multiple-choice questions to measure safety culture across three categories of safety management: (1) 
leadership, (2) processes and actions, and (3) structure [59, p. 2]. The survey addresses only 12 of DuPont’s 22 
essential elements of an integrated safety management system (Figure 42). It focuses on elements it labels 
“cultural” and places under “Management Commitment” and does not address components related to what it 
calls “risk-based” process safety, such as management of change. According to DuPont Sustainable Solutions, 
the Bradley Curve benchmarking system, combined with DuPont’s Safety Perception Surveys, has helped 
DuPont and its clients improve their safety culture performance [78]. 


a A safety management consultant and former DuPont executive developed the Safety Perception Survey, which was first published in 
1999. DuPont acquired the survey in 2000. DuPont modified it and incorporated it into its consulting methodology for benchmarking 
and action planning [59, p. 2]. 
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Figure 42. To DuPont, Each Wheel Represents Different Aspects of Safety. The wheel on the left 
(Cultural) represents the only aspects of safety that DuPont's Safety Perception Surveys cover. 

The wheel on the right (Risk-Based) represents aspects of safety typically associated with process 
safety. Source: DuPont. 

Beginning in 2007, DuPont began calculating a “Relative Culture Strength” (RCS) score based on responses to 
the Safety Perception Surveys. a DuPont found that higher RCS correlated with a lower OSHA total recordable 
injury rate. b The correlation also fit the Bradley Curve (Figure 43) [59, p. 7]. Because of this correlation, 
DuPont often uses the OSHA total recordable injury rate “as [its] measure of safety performance” [59, p. 2]. 
Additionally, DuPont uses the RCS in combination with the Bradley Curve (Figure 43) to determine what stage 
of safety culture a facility has achieved. The curve represents the progress of a facility’s culture strength. The 


a RCS is a proprietary number calculated by comparing a company’s responses to survey questions against a benchmark established by 

DuPont in 2008 based on the best and worst sites that had taken the Safety Perception Survey [59, p. 3]. 

b The OSHA recordable injury rate is the annual number of injuries and illnesses per 100 full-time workers. The 

OSHA injury rate, which excludes fatalities, is a normalized rate that is used for comparison across industries [171, p. 75]. 
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higher the score, the further along the facility is on the curve, with the highest level designated “World Class.” a 
DuPont classified facilities with a calculated RCS value of 80 or greater as having a “World Class” safety 
culture. Results from a 2012 Safety Perception Survey conducted at the La Porte site, the last safety culture 
survey conducted at the site before the incident, classified its perception of safety performance as “World 
Class.” This safety classification, however, relied on the DuPont La Porte site’s employees’ perception of 
personal (worker) safety performance only, because the Safety Perception Survey used at DuPont La Porte did 
not include process safety considerations. 



DuPont Bradley Curve with RCS 

Figure 43. DuPont Bradley Curve with Plotted RCS results from 169,000 Safety Perception Surveys. The yellow bars show the range 
of the middle 50 percent of the data in each category, and the horizontal blue line in each box indicates the median. DuPont found 
that a higher RCS correlated with a lower worker injury rate (OSHA total recordable injury rate). Source: DuPont. 


a The Safety Perception Survey ranks performance by five categories (from best to worst): World Class, Excellence, Skill, Awareness, 
and Fundamentals. World Class is defined as “the organization leads its industry in safety performance as a direct result of its safety 
focus, leadership, deliberate organizational design, and the portfolio of activities it carries out to maintain a safe workplace.” Excellence 
is defined as “the organization has strong capabilities to identify, learn from, and correct at-risk behaviors and workplace hazards. Safety 
is a top priority. There is a free flow and exchange of information without the fear of retribution, and the organization is focused on 
learning and improving. Hazard reporting, auditing, and corrective implementation are well designed and executed on a regular basis.” 
The Skill level is defined as “the organization shows numerous signs of continuous improvement and has a track record of modest and 
consistent improvement in safety performance. Personnel are skilled in the application of basic safety management tools and 
techniques.” The Awareness level is defined as “the organization is aware of its performance and has established basic policies and 
processes to measure and improve safety performance. There is relatively high value for safety efforts, and an auditing system is in place 
to eliminate workplace hazards.” The Fundamentals level is defined as “the organization has processes in place to avoid known 
workplace hazards and uses trailing injury statistics for performance measurement. Injuries and incidents are the main driving force 
behind discussion of safety management practices. There is a written safety policy that may not be familiar to employees or be perceived 
as of high value. Safety performance is known to some in the organization but is not widely known or thought out.” 
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DuPont Sustainable Solutions responded to the new learnings about process safety culture after BP Texas City 
by developing 13 new process safety questions for its Safety Perception Surveys. These questions are 
considered optional and may be included in the survey at clients’ request. 
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